Organizations that left unused Qubole cross-account roles in place were exposed, and the researchers have not yet said how the attacker obtained the credentials.
The brief tampering windows mean organizations that checked for updates during that period may have been exposed without seeing obvious warning signs.
The breach cut across Bitget’s wallet operations, forcing it to stop withdrawals while it tries to contain and recover the stolen funds.
For unpatched organizations, a WAF rule matching the usual route is no substitute for Oracle’s security update.
Customers remain unable to withdraw funds until investigators approve a safe restart.
The inside access let Google track the campaign, warn targets and feed police data that preceded two arrests in Australia.