Bitget blames third-party flaw for $388M theft

Bitget said an attacker stole about $388 million after exploiting a flaw in a third-party security product used by the exchange. It said the attacker obtained high-level internal credentials and used them on 24 September to send withdrawal commands to its wallet system.

The exchange said the stolen funds came from part of its hot and warm wallets, while cold wallets were not affected. It had previously said that a backend wallet system had been compromised and used to fake transaction data, but had not explained how the attacker gained entry.

Gracy Chen, Bitget's chief executive, described the incident in a livestream and in comments reported by The Block and Cointelegraph. She said the flaw allowed access to an internal management system, and that the attacker made two small test transfers at 18:31 UTC before larger transfers followed about 30 minutes later.

Bitget said no private keys had been compromised, based on its investigation so far. It said it had notified the vendor, isolated affected systems, revoked and reissued internal credentials, and turned off the affected function while the issue was addressed.

The exchange said its Protection Fund would cover the loss. Bitcoin withdrawals reopened on Monday, and other assets were due to follow in stages through 2 October. TRM Labs said it had found overlaps between the stolen funds and wallets used in earlier North Korean thefts, and said that pointed to TraderTraitor, although it did not make a firm attribution.