Bitget Traces Its $388M Theft to a Zero-Day in a Vendor's Tool

Bitget has given its account of the 24 September theft, and it points at a supplier. Chief executive Gracy Chen said the attacker exploited a zero-day flaw in a third-party security product wired into the exchange's systems, took high-level internal credentials, and sent withdrawal instructions that the wallet backend processed as ordinary administration. No private keys were taken. Hot and warm wallets were emptied, cold storage was untouched, and the exchange says customer balances are intact. The total it gives is $388 million.

Two small transfers came first

The attacker tested the alarm before tripping it. At 18:31 UTC on 24 September, 0.184 ETH left an Ethereum hot wallet and 193 TRX left a Tron hot wallet, both sized under the threshold that would have tripped a risk system, on The Block's account of an interview with Chen published Monday. The large transfers followed. On the timeline the exchange supplied to u.today and Metaverse Post, a first wave of 17 transactions worth about $361 million ran between 18:58 and 20:09 UTC, and a second wave of seven transactions worth about $30 million ran between 20:55 and 21:23.

The Hacker News, writing the same day, puts the start of the large withdrawals at roughly 19:01 UTC and about half an hour after the tests. That is three minutes later than the exchange's own clock, and neither account cites the other. The waves are also short of the headline. Adding them gives about $391 million against a stated total of $388 million, and nothing read here reconciles the two.

Seven minutes to detection

Monitoring flagged a discrepancy at 19:05 UTC, seven minutes after the first large transfer on the exchange's own reckoning. A P0 emergency was declared at 19:14 and containment work began at 19:40. The wallet team started moving funds to cold storage at 20:40, the second wave ran at 20:55, and withdrawal services were shut at 21:44. Detection did not stop the outflow for another two and a half hours. Chen said the cleanup behind the attack was the trickiest part of the work.

"Along the way, they used legitimate credentials. They disguised their activity as routine administrative operations while removing traces of their actions," Chen said.

Mandiant and SlowMist are working the investigation alongside the exchange. Nine chains were touched, Ethereum and Tron among them. Bitget has not named the third-party product, and no outlet read here names it either. A formal incident report was expected this week and had not appeared at the time of writing.

What covers the hole

The backstop is the exchange's user protection fund, and its size is not agreed. The Block puts it at $465 million as of 25 September, while u.today and Metaverse Post both give $464 million. The gap is a million dollars, neither figure carries a different as-of date, and we could not establish which supersedes the other. Bitget has committed to returning at least $300 million in USDT to the fund within a week of drawing on it, and points to corporate reserves above $1.4 billion in its 31 August audit and a proof-of-reserves ratio of 127%.

Withdrawals reopen asset by asset

Bitcoin withdrawals restarted at 08:00 UTC on Monday, four days after the pause, under the phased schedule the exchange set out last week. For the first hour, u.today and Metaverse Post report 9,585 requests moving 4,098.04 BTC. The Block's write-up of the same hour says more than 3,000 BTC. Ether was due on 29 September, USDT on 30 September, and the remaining tokens, fiat and peer-to-peer services on 2 October. Getting the stolen funds back is a separate problem, and one route is closed: THORChain told Chen it would not refuse service to the wallets holding them.

Chen said the group the exchange suspects has not changed since the first days, and declined to name it ahead of the report. The tally has moved more than the suspicion has. This desk carried $351.6 million on 25 September and $387.5 million a day later. Whether $388 million is the final figure depends on a document that has not been published.