Bitget confirmed on Wednesday that the attackers who took $387.5 million last week got in through a zero-day flaw in third-party security products. The exchange cited findings from its ongoing investigation.

A zero-day is a flaw the vendor did not know about, so no patch existed on the day of the theft. The product in question is meant to protect the thing that was robbed.

The new statement describes the entry point as a flaw in a third-party product. It gives no product name, no vendor name and no CVE identifier.

That leaves a gap of one unnamed vendor. Every other customer of that product is now holding a flaw that was sufficient to move $387.5 million, and none of them can look it up. There is nothing to patch against, nothing to search for in the logs and nothing to put in a ticket.

"Products" is plural in the statement. It does not say whether one vendor or several are involved.

The control that would have changed the outcome is not one Bitget has described, because a zero-day by definition beats the patch queue. What would help every other customer is the vendor's name, a CVE and indicators of compromise. Until Bitget or the vendor publishes them, nobody running that product can check whether it has already been used against them.