Blockchain security firm SlowMist has traced activity connected to the Bitget hack to a zero-day exploit dated Aug. 31, according to the firm's on-chain analysis reported by LCX Exchange.

The finding anchors the incident to a specific vulnerability window rather than a prolonged intrusion, a distinction that matters for how exchanges, auditors and investigators reconstruct the sequence of a breach. A zero-day, by definition, is a flaw exploited before a patch or public disclosure exists — meaning the attacker operated against defenses that had no known signature for the technique in use.

SlowMist, a security firm known for on-chain forensics and incident tracking across major exchange compromises, reached the Aug. 31 dating through transaction analysis. Tracing exploit activity to a precise date allows investigators to separate the initial compromise from subsequent fund movements, wallet rotations and laundering stages that typically follow a large exchange breach.

For Bitget, the attribution carries operational consequences beyond the immediate loss. Establishing that a zero-day was involved shifts the frame of the incident from operational error toward a targeted attack on undisclosed software weaknesses — a category of threat that standard security reviews and penetration tests cannot reliably catch. Exchanges confronting zero-day-driven intrusions generally face pressure to disclose which component was exploited, whether the vendor responsible has patched it, and whether other platforms running the same stack remain exposed.

The timeline also matters for the recovery and enforcement picture. Once an exploit window is fixed to a date, law enforcement and blockchain-analytics firms can bound the universe of relevant addresses and transactions, improving the odds of freezing funds before they pass through mixers or cross-chain bridges. Each hop in the laundering chain reduces traceability, which makes early dating of the initial exploit a structurally important input into any seizure effort.

Bitget has not publicly detailed the full scope of the incident, and the precise financial impact has not been independently verified in the reporting available. SlowMist's Aug. 31 attribution represents the clearest public marker so far of when attacker activity began.

The disclosure arrives amid a broader hardening of institutional expectations around exchange security transparency. Regulators in major jurisdictions increasingly expect timely incident reporting, and security firms' on-chain findings frequently surface before official statements from the affected platform. That sequencing pressures exchanges to reconcile their disclosures with third-party forensic timelines or risk credibility gaps with users and partners.

For other centralized exchanges, the SlowMist finding functions as a prompt to audit for related exposure. If the zero-day resided in commonly used infrastructure — wallet management software, signing systems or third-party services — the vulnerability could implicate more than one platform. Confirmation of the affected component would determine whether this is an isolated incident or a systemic risk across the sector.

SlowMist has not publicly named the specific software or vendor behind the zero-day, leaving that question open. Expect the next phase of the incident to turn on whether Bitget or the responsible vendor discloses the exploited component, and whether follow-on on-chain tracking identifies frozen or recoverable funds as investigators work the addresses tied to the Aug. 31 activity.