Bitget Hacker Used Zero-Day and Test Transfers Before $388M…

Bitget has published a fuller account of the Sept. 24 security breach that cost the exchange roughly $388 million, saying the attacker chained a zero-day vulnerability in a third-party security product to valid administrative credentials and then injected fraudulent withdrawal instructions into wallet backend systems. CEO Gracy Chen said the exchange initially reported about $351.6 million in affected assets, a figure later revised to approximately $387.5 million after additional Zcash and TRON transactions were reconciled.

The attack began at 18:31 UTC with two small unauthorized transfers — 0.184 ETH from an Ethereum hot wallet and 193 TRX from a Tron wallet. Both sat below Bitget's risk-control threshold and triggered no alert. About half an hour later, between 18:58 and 20:09 UTC, the attacker executed 17 larger transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche worth roughly $361 million. Bitget's reconciliation system flagged a major discrepancy at 19:05 UTC, seven minutes after the larger withdrawals started, and the exchange halted user-initiated withdrawals platform-wide.

How the transactions looked legitimate

Chen said private keys were never stolen. Instead, the zero-day gave the attacker entry to an internal management system using valid admin credentials, allowing fraudulent transaction data to pass through authorised signing infrastructure as if it came from legitimate internal systems. A separate GoPlus Security assessment reached a similar conclusion, pointing to Bitget's transaction-signing trust chain rather than its keys. Chen described the attacker's deletion of traces tied to the forged commands as the trickiest part of the case. Bitget says cold wallets were untouched, the underlying vulnerability has been identified and remediated, and Mandiant and SlowMist are assisting the investigation.

Bitget says its User Protection Fund, valued at about $465 million on Sept. 25, will absorb the loss. Chen said the company plans to replenish it to at least $300 million within a week from corporate reserves, which stood above $1.4 billion as of an Aug. 31 audit. "An incident like this scale is very serious," she said. "But serious doesn't mean existential."

Withdrawals are returning in phases. BTC resumed on Monday, with more than 3,000 BTC processed in the first hour. ETH reopens on Sept. 29 across Ethereum, BSC, Arbitrum, Base and Optimism, USDT follows on Sept. 30, and other tokens, fiat withdrawals and peer-to-peer services are due to return on Oct. 2.

Recovering the funds is a separate challenge. About $83 million of the stolen XRP has been moved by the attacker, and only a small portion of the wider haul has been immobilised through issuer-level freezes. Chen declined to name the suspected attackers before the formal incident report is published, saying Bitget continues to suspect the same group investigators have been examining.