Hackers were inside the Bitget infrastructure for at least 25 days before the theft of $ 388 million — according to SlowMist, the first trace of the hack appeared on August 31 through a vulnerability in a third party

Hackers were inside the Bitget infrastructure for at least **25 days before the $388 million theft — according to [SlowMist] (https://github.com/slowmist/Knowledge-Base/tree/master/open-report-V2/incident-response), the first trace of the hack appeared on August 31 via a vulnerability in a third-party security service.

Private keys were not stolen - the attackers received internal credentials and forced the system itself to approve fake withdrawals.

Some of the stolen items were then driven through CoW Protocol, Chainflip and other cross-chain services.