SlowMist discloses investigation progress into Bitget's hot wallet theft, with the attack involving a vulnerability in a third-party security product.
SlowMist, a leading blockchain security firm, announced in a statement that Bitget has commissioned its security team to investigate the hot wallet asset theft incident that occurred on September 25. As of September 29, SlowMist’s investigation found the attack involved malicious activities targeting a third-party security product, the wallet application’s host, and a custom withdrawal tool developed by the attacker.
The investigation revealed the attacker’s key attack methods: exploiting a zero-day vulnerability in the third-party product to carry out malicious operations; using an internal employee’s identity to gain unauthorized access to the third-party product’s management platform on September 25; obtaining and deploying a custom withdrawal tool tailored for the wallet’s withdrawal logic; on-chain activity began at 02:31 UTC+8 on September 25, with the attacker transferring assets across multiple blockchains over roughly 2 hours and 52 minutes; the attacker later attempted to alter withdrawal records and triggered additional BTC withdrawals.
SlowMist noted that it is still investigating how the attacker performed lateral movement between the affected systems.
9 minutes ago
A crypto whale’s long PUMP position has multiplied its principal sevenfold, generating an unrealized profit of $2.1 million.
According to TradingBeats' monitoring, PUMP has surged 18.2% today. A whale on Hyperliquid holds 1 billion PUMP with 10x leverage, at an average entry price of $0.00358. The current position is valued at roughly $5.76 million, with an unrealized profit of approximately $2.18 million, translating to a return of around 608%. This latest rally has added about $888,000 to its unrealized profit, which remains unrealized. Currently, this address has a buy-the-dip order for PUMP placed at $0.00278, with a planned investment of around $16.3 million, and the order price is roughly 51.8% lower than the current market price.
9 minutes ago
On the third day of Bitget’s resumed withdrawals, net fund inflows have turned positive, with over 28,000 ETH flowing into the exchange.
According to EmberCN’s monitoring, Bitget’s withdrawal window has entered its third day, with the peak withdrawal period now over and the platform’s funds shifting to net inflow. Data shows that since ETH withdrawals opened, Bitget has seen ETH inflows of around 28,900 coins and outflows of approximately 7,266 coins, with inflows significantly outpacing outflows. Address 0x714…d22 is the largest depositing address; it withdrew 20,000 ETH (worth roughly $54.66 million) from Lido last night and transferred the funds to Bitget to participate in the ETH pool’s 11.27% APR campaign. Additionally, data indicates Bitget recorded a net inflow of approximately $9.47 million yesterday, and a net inflow of around $31.73 million between 0:00 and 8:00 today.
9 minutes ago
A new address withdrew approximately 5,732 ETH from Coinbase Prime, valued at around $15.31 million.
According to Arkham monitoring, a new crypto address withdrew 5,731.90 ETH from Coinbase Prime, valued at approximately $15.31 million. As of press time, all ETH received by the address remains held, with no outgoing transfers initiated. Address: 0x149308592a2d1d91c0afc722f59ec1e2a177f002
9 minutes ago
Bank of Korea to resume physical gold purchases in December, first such move in 13 years.
South Korean media outlet MoneyToday reported that the Bank of Korea will purchase 1 ton of domestically produced gold in December, marking its first acquisition of physical gold in 13 years. The central bank disclosed in August this year that it had bought gold ETFs, which was its first investment in gold assets in the same 13-year period.
9 minutes ago
SlowMist discloses investigation progress into the Bitget hot wallet theft, with the attack involving a vulnerability in a third-party security product.
SlowMist, a leading blockchain security firm, has released a statement noting that crypto exchange Bitget has commissioned its security team to investigate the hot wallet asset theft incident that occurred on September 25. As of September 29, SlowMist’s investigation found the attack involved malicious activities targeting a third-party security product, the wallet application’s host, and a custom withdrawal tool developed by the attacker. The investigation revealed the attacker’s key attack methods: exploiting a zero-day vulnerability in a third-party product to conduct malicious operations; using an internal employee’s identity on September 25 to gain unauthorized access to the third-party product’s management platform; obtaining and deploying a custom withdrawal tool tailored to the wallet’s withdrawal logic; on-chain activity starting at 02:31 UTC+8 on September 25, during which the attacker transferred assets across multiple blockchains over approximately 2 hours and 52 minutes; and later attempting to alter withdrawal records to trigger additional BTC withdrawals. SlowMist added that it is still investigating how the attacker moved laterally between the affected systems.
9 minutes ago
App Store
Profile
Security
Sign Out
Feeds
Articles
Source
Add to Favorites
Download image
Share x
Copy link
