Crypto exchange Bitget has disclosed new details about the security breach that resulted in approximately $388 million in cryptocurrency being transferred to attacker-controlled addresses on September 24. According to CEO Gracy Chen, the attacker gained access by exploiting a vulnerability in a third-party security product, rather than directly compromising Bitget's private keys.

The vulnerability reportedly allowed the attacker to obtain high-level internal credentials and access an internal management system connected to Bitget's wallet infrastructure. From there, fraudulent withdrawal commands were inserted into backend systems and processed as legitimate operations. The attack therefore targeted the exchange's transaction authorization process rather than simply stealing private keys. Bitget said its cold wallets were not affected, and its private keys were not compromised.

The incident began with two small unauthorized transfers that were used to test the exchange's controls. According to Chen, the attacker transferred 0.184 ETH and 193 TRX at around 6:31 p.m. UTC on September 24. Both transactions were below Bitget's risk-control threshold and did not trigger an alert. Roughly 30 minutes later, the attacker initiated larger transfers across several blockchain networks.

Bitget's initial estimate placed the affected assets at around $351.6 million, but subsequent onchain analysis increased the figure to approximately $387.5 million after additional transactions involving Zcash and TRON were identified. Bitget said the higher figure represented a more complete accounting of the original incident rather than additional unauthorized transfers.

The stolen assets were moved from several hot and warm wallets across multiple networks, including Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche. Bitget detected a significant discrepancy within minutes of the larger transfers beginning and subsequently suspended customer withdrawals as a security precaution.

The exchange has since patched the vulnerability and tightened its withdrawal controls. Bitget said it has restricted internal access, introduced additional independent verification for withdrawals and increased monitoring for unusual activity. Mandiant and SlowMist are assisting with the forensic investigation. Bitget has also begun progressively restoring withdrawal services, with Bitcoin withdrawals reopened on September 28 and additional assets scheduled to return in stages.

Bitget has not yet disclosed a final figure for recovered or frozen assets. The company said some stolen funds have been frozen with assistance from other industry participants, but it will publish a verified recovery figure after confirming the amounts. The exchange is also continuing to investigate an earlier possibility that the attackers could be connected to North Korea-linked threat actors, but Chen said that attribution remains under investigation and has not been confirmed.

The breach highlights a broader cybersecurity risk for cryptocurrency exchanges: even when private keys remain protected, vulnerabilities in third-party software, internal credentials and transaction approval systems can provide attackers with another route to move assets. The incident also demonstrates why exchanges require multiple independent controls around withdrawals, particularly when administrative credentials can interact with wallet infrastructure.