Bitget says $388M exploit used a third-party security flaw to steal internal credentials

Bitget CEO Gracy Chen said the exchange’s recent $388 million incident was not a straight break-in of its own key management, but the result of a vulnerability in a third-party security product that gave the attacker “high-level internal credentials.” For PSPs and exchanges, that is the part worth noting: once an attacker can issue withdrawal commands from inside the perimeter, the rest of the architecture starts looking more like damage control than prevention.

1. In comments to Cointelegraph, Chen said the attacker used those internal credentials to submit fraudulent withdrawal commands. Bitget said its private keys were not compromised and its cold wallets were not affected, which narrows the failure to access control and internal authorization rather than custody infrastructure itself.
2. The attack took place on Sept. 24, when Bitget detected unauthorized transfers from several hot wallets and temporarily suspended withdrawals. The exchange initially estimated that about $352 million in assets had been affected, before later describing the incident as a $388 million exploit.
3. Bitget said it has since addressed the security flaw and tightened withdrawal controls by restricting internal access, adding independent verification for withdrawals, and increasing monitoring for unusual activity. In practice, that is the standard post-incident playbook: reduce who can trigger payouts, force a second set of eyes, and watch the rails more closely than you did before.
4. The exchange has not disclosed how much of the stolen crypto has been recovered or frozen. Chen said some assets have been frozen with help from other industry participants, but Bitget will release a total only after verifying the amounts.
5. Bitget had earlier asked THORChain, a protocol for swapping assets between blockchains, to refuse services to addresses linked to the attack. THORChain said it cannot selectively blacklist individual addresses, and Chen said Bitget is not asking THORChain to halt its network, only to refrain from actions that are technically possible under the protocol’s design.

Chen also walked back Bitget’s earlier suspicion that North Korea may have been behind the attack. She said the previous comment was based on preliminary indicators and that Mandiant and SlowMist are supporting the independent forensic investigation, which is still ongoing.