Bitget says September breach moved $387.5 million from wallets

Bitget says attackers transferred $387.5 million from some of its exchange hot and warm wallets on Sept. 24, exposing a backend weakness even as customer account balances remained unaffected. The exchange’s official incident update says the transfers were detected at 18:31 UTC and went to addresses controlled by the attackers.

The final estimate is higher than Bitget’s earlier figure of $351.6 million. The exchange says the revision followed on-chain tracing, which added Zcash and Tron assets; it does not reflect a second theft. The Block reported Bitget’s updated total and its statement that the incident was contained.

How did attackers get transfers past Bitget’s controls?

Bitget says attackers exploited a vulnerability in a third-party security product to steal credentials for its internal network. They used those credentials to write forged withdrawal instructions into the wallet system, which treated them as normal withdrawals and bypassed risk checks.

The exchange says the breach involved 12 hot and warm wallet addresses. Hot wallets are connected to systems used for routine transactions; warm wallets are also used to move funds but have additional security measures. Bitget says the attackers did not compromise private keys. Its cold wallets, which hold most platform assets, were unaffected.

The affected assets included ETH, XRP, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX across several blockchain networks. Bitget’s update says the attackers deleted traces of the forged instructions after the transfers, complicating the investigation.

What did Bitget say about customer funds and withdrawals?

Bitget says user account balances were not affected and the financial impact will be covered by its Protection Fund. The company reported that the fund held 5,500 BTC, worth more than $464 million at the time of its update.

The exchange suspended withdrawals as it reviewed its systems, while deposits and trading remained available, The Block reported. Bitget later published a phased withdrawal schedule: its incident page records that BTC withdrawals resumed Sept. 28 and ETH withdrawals on Sept. 29. It listed later dates for USDT and other services, though the page’s schedule still marks those entries as pending.

Who is investigating the breach?

Bitget says cybersecurity firms Mandiant and SlowMist conducted independent investigations. In a Sept. 30 update, the exchange said both investigations identified compromised third-party security products as the route to unauthorized access to its wallet environment.

Bitget says it has fixed the vulnerability, reset internal credentials and tightened access to sensitive permissions. The company said a fuller technical report would follow.