Bitget attacker tested risk controls with small transfers before $388 million theft, CEO says

The attacker behind Bitget's $388 million exploit first probed the exchange's risk controls with two small transfers roughly half an hour before carrying out the main theft, CEO Gracy Chen said in an interview with The Block's Gareth Jenkinson.

According to Chen, the first unauthorized transfers occurred at 6:31 p.m. UTC on Sept. 24, when 0.184 ETH left an Ethereum hot wallet and 193 TRX left a Tron hot wallet. Both amounts fell below Bitget's risk-control threshold and generated no system alerts. About 30 minutes later, the attacker moved to larger sums: 17 transactions spread across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche between 6:58 p.m. and 8:09 p.m. UTC, totaling roughly $361 million in crypto.

Detection and response

Bitget's reconciliation system flagged a significant discrepancy within seven minutes of the first large transfer, at 7:05 p.m., and the risk system then blocked user-initiated withdrawals across the platform, Chen said.

By that point, however, the attacker had already reached an internal management system by exploiting a zero-day vulnerability in a third-party security product. That access let them insert fraudulent withdrawal commands directly into wallet-related backend systems, where the commands were treated as legitimate, Chen said. The attacker then deleted the traces left by those commands, complicating Bitget's effort to reconstruct what happened.

"It's also, in my opinion, the trickiest part," Chen said of the deleted traces.

Bitget has maintained that private keys and cold wallets were not compromised. The exchange is working with Mandiant and SlowMist and expects to publish a formal incident report within the week. On attribution, Chen said, "It's still the same group of people that we suspect," but declined to name them before the report is released.

Bitget's user protection fund, valued at $465 million on Sept. 25, will absorb the loss. Chen said the fund will be replenished to at least $300 million within a week from corporate reserves, which stood at more than $1.4 billion as of an Aug. 31 audit.

"An incident like this scale is very serious," Chen said. "But serious doesn't mean existential."

BTC withdrawals resumed on Monday and processed more than 3,000 BTC in the first hour, while ETH withdrawals are set to reopen on Sept. 29.