Bitget CEO Says $388M Hack Came From a Third Party Security Flaw

Bitget’s chief executive says the recent $388 million exploit started with a weakness in an outside security product, which handed the attacker high level internal credentials.

How the Bitget Exploit Happened

Gracy Chen said the attacker used those credentials to send fraudulent withdrawal commands. She said Bitget’s private keys were not compromised and its cold wallets were not touched. The attack took place on Sept. 24, when the exchange spotted unauthorized transfers from several hot wallets and paused withdrawals. It first estimated the affected amount at about $352 million.

Security Fixes After the Bitget Breach

Bitget said it has patched the flaw and tightened withdrawal controls. Changes include restricting internal access, adding independent verification for withdrawals and increasing monitoring for unusual activity.

Stolen Crypto Recovery and THORChain

Some stolen assets have been frozen with help from other industry players, Chen said, but Bitget will publish a total only after verifying the numbers. The exchange had urged THORChain, a cross-chain swap protocol, to refuse services to addresses tied to the attack. Chen said Bitget is not asking any protocol to do something technically impossible, and THORChain has said it cannot blacklist individual addresses.

North Korea Link Still Unconfirmed

Chen said Bitget’s earlier suspicion of North Korea was based on preliminary indicators that are still being assessed. Mandiant and SlowMist are supporting an independent forensic investigation, and further findings will be shared once verified.