SlowMist has released the latest investigation conclusions on the Bitget security incident. The conclusions trace the source of the theft of approximately $388 million from Bitget to a zero-day vulnerability that emerged on August 31, and state that related attack activity occurred before the incident officially occurred. SlowMist also disclosed the existence of the zero-day vulnerability and the attack chain. This investigation update means the key timeline is no longer limited to the moment the fund loss occurred, but extends backward to the period when the vulnerability emerged and attack activity unfolded.
The high level of attention on this Bitget security incident is directly related to the approximately $388 million amount involved. SlowMist, as the investigating party, has disclosed new developments around the incident. Based on currently disclosed information, the core conclusions of the investigation cover three aspects: first, the August 31 zero-day vulnerability; second, the timeline relationship in which attack activity preceded the incident; and third, the revelation of the attack chain. Together, these constitute the main information framework of this investigation.
Regarding the source of the vulnerability, the conclusion disclosed by SlowMist explicitly points to August 31. August 31 therefore becomes a key time coordinate in this incident. This information indicates that the vulnerability emerged on August 31, and that this time point is earlier than the incident officially occurred. In other words, the incident did not begin to take shape only at the moment of public exposure; its technical risk source can be traced back to August 31.
Regarding chronology, SlowMist's investigation conclusion states that attack activity already existed before the incident officially occurred. This judgment distinguishes attack activity from the incident itself and avoids treating the emergence of the vulnerability, the attack activity, and the public outbreak of the incident as the same moment. Currently disclosed information does not further specify how far in advance the attack activity took place, but it has clarified the sequence between the two. Based on available information, a basic timeline can be formed: the zero-day vulnerability emerged on August 31; the attack activity occurred after that but before the incident officially occurred.
Regarding the attack chain, SlowMist in this investigation update also revealed the zero-day vulnerability and the attack chain. Currently disclosed information lists the zero-day vulnerability and the attack chain as core content revealed by the investigation. It should be noted that the existing disclosure does not provide the specific steps or technical path of the attack chain; relevant details remain to be disclosed.
Based on currently confirmable facts, SlowMist's conclusions focus on several aspects: first, the Bitget security incident involves approximately $388 million; second, the source of the incident is the August 31 zero-day vulnerability; third, attack activity preceded the incident; fourth, the investigation revealed the zero-day vulnerability and attack chain. These four points together constitute the core facts disclosed by this investigation and do not involve more verifiable technical details.
The approximately $388 million amount involved is an important feature of this security incident. From the disclosure, this amount is key monetary information for the Bitget security incident and one of the main reasons the incident has received relatively high attention. Precisely because the amount is large, the conclusions in the investigation update regarding the vulnerability source and chronology have attracted more market attention.
Putting together the two information points—the August 31 zero-day vulnerability and attack activity preceding the incident—can further clarify the incident timeline: the zero-day vulnerability emerged on August 31; attack activity had already occurred before the incident officially occurred. As for the specific start time of the attack activity and the specific time span between it and the incident, existing disclosure does not explain this, so no further inference can be made. This point needs to await clarification from SlowMist or Bitget in subsequent information.
Therefore, within the scope of existing information, the investigation progress on the Bitget theft incident can be summarized as follows: SlowMist points the source of the incident to the August 31 zero-day vulnerability, confirms that attack activity preceded the incident, and reveals the attack chain; the amount involved is approximately $388 million. The above constitutes the core facts disclosed by SlowMist this time.
Directions worth watching going forward mainly include: whether SlowMist will further disclose specific details of the zero-day vulnerability and attack chain; whether the specific time span by which attack activity preceded the incident will be clarified in subsequent investigation; and whether Bitget will make further progress in follow-up handling and external communication regarding the security incident. These questions currently remain undisclosed or unverifiable and should not be understood as confirmed facts. Based on currently disclosed information, the August 31 zero-day vulnerability, the approximately $388 million amount involved, and the judgment that attack activity preceded the incident are the most central information in SlowMist's investigation conclusions.