Bitget hack traced to August; fund gap still real

SlowMist's forensic investigation into the Bitget breach has identified malicious activity dating to August 31, weeks before the incident became public. The attack used a zero-day vulnerability, two security products, and a custom withdrawal tool built specifically for the operation. Bitget CEO Gracy Chen confirmed the exchange's protection fund, established in 2022, absorbed the financial impact. User losses totalled $388 million. The fund has since recovered to $309 million.

The pre-disclosure window is the critical detail here. The breach was active and operational while the exchange continued normal business. That means any operator, treasury, or payment rail running through Bitget during that period was transacting on a compromised platform without knowing it. This is not a post-breach risk. It was a concurrent risk that went undetected.