The hack originated from a zero-day vulnerability in a third-party security product used by Bitget