TheBlock
Bitget CEO Gracy Chen said the attacker sent two small unauthorized transfers about 30 minutes before the exchange's $388 million exploit. At 6:31 p.m. UTC on Sept. 24, 0.184 ETH and 193 TRX moved from hot wallets without triggering alerts because both transfers fell below risk-control thresholds.
Why it matters
The attacker later used a zero-day vulnerability in a third-party security product to access an internal management system and insert fraudulent withdrawal commands into wallet-related backend systems. Chen said the commands appeared legitimate, and the attacker deleted traces of them, complicating the investigation. Bitget says its private keys and cold wallets were not compromised.
The attack spanned 17 transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche. Those transfers totaled about $361 million between 6:58 p.m. and 8:09 p.m., while the reported overall theft was $388 million. Bitget's reconciliation system detected a discrepancy within seven minutes of the first large transfer, and the exchange then blocked user-initiated withdrawals platform-wide.
Market impact
Bitget says its $465 million user protection fund, valued on Sept. 25, will absorb the loss. Chen said the exchange plans to replenish the fund to at least $300 million within a week using corporate reserves, which exceeded $1.4 billion in an Aug. 31 audit. She called the incident serious but not existential.
BTC withdrawals resumed Monday, processing more than 3,000 BTC in the first hour. ETH withdrawals were scheduled to open Sept. 29. Bitget is investigating with Mandiant and SlowMist and expects to publish a formal incident report this week.
Frequently asked questions
-
How did the attacker test Bitget's risk controls?
The attacker sent 0.184 ETH and 193 TRX from hot wallets. Both transfers fell below the exchange's risk-control threshold and triggered no alerts.
-
How did the attacker gain access to Bitget's backend systems?
CEO Gracy Chen said the attacker exploited a zero-day vulnerability in a third-party security product to access an internal management system and insert fraudulent withdrawal commands.
-
How quickly did Bitget detect the larger transfers?
Bitget's reconciliation system detected a significant discrepancy within seven minutes of the first large transfer. The exchange then blocked platform-wide user-initiated withdrawals.
-
What will cover the reported $388 million loss?
Bitget says its user protection fund, valued at $465 million on Sept. 25, will absorb the loss. Chen said the exchange plans to replenish it to at least $300 million within a week.
-
Which withdrawals resumed after the exploit?
BTC withdrawals resumed Monday and processed more than 3,000 BTC in the first hour. ETH withdrawals were scheduled to open Sept. 29.
Crypto News
CryptoSlate
WuBlockchain
CoinDesk
Lookonchain
CoinTelegraph