Bitget Says Third-Party Zero-Day Enabled $387.5M Hot-Wallet Breach

Two weeks after one of the largest exchange breaches of 2026, Bitget has restored withdrawals across its platform and published its explanation of how attackers moved roughly $388 million out of its hot and warm wallets. According to the exchange's official incident page, updated October 13, a zero-day vulnerability in a third-party security product gave attackers a path into internal management systems. From there they forged withdrawal commands. Independent investigation reports from Mandiant (a Google Cloud company) and SlowMist were released on September 30; Bitget's own formal security report has been promised but not yet released.

Timeline

Bitget says its security system detected unauthorized transfers at 18:31 UTC on September 24, 2026. The exchange suspended withdrawals and kept deposits and trading open. Its first public estimate put the loss at $351.6 million, Hackread reported. The next day Bitget raised the figure to $387.5 million, which it said "was transferred to attacker-controlled addresses," according to BleepingComputer. The incident page now describes the affected funds as about $388 million across 12 wallet addresses.

Withdrawals then reopened in stages, all at 08:00 UTC:

September 28: BTC on the Bitcoin network.
September 29: ETH on Ethereum, BSC, Arbitrum, Base and Optimism.
September 30: USDT on Ethereum, BSC, Solana and Tron.
October 2: all other cryptocurrencies, fiat and peer-to-peer.

Bitget says the schedule applied to all users equally, with no priority by account tier.

Root cause, as described by Bitget

Bitget's account of the attack changed as the investigation went on. In the first days, chief executive Gracy Chen said attackers had breached a backend system in the wallet infrastructure and used it to "spoof transaction data," which tricked the exchange's authorization process into approving payouts (Decrypt via Yahoo Finance). She said the attackers neither forged customer withdrawal requests nor obtained private keys.

The incident page now gives more detail. It says a "third-party security product used by Bitget contained a zero-day vulnerability." Attackers used it to reach internal management systems, then used stolen high-privilege credentials to write forged withdrawal commands directly into the wallet system, bypassing risk checks. After the transfers, they deleted traces of the forged commands. Bitget maintains that "private keys were not compromised, and cold wallets were unaffected." Independent investigation reports from Mandiant and SlowMist were released on September 30, according to the incident page, which adds that Bitget's own formal security report "will be released shortly, disclosing more complete technical details." Bitget has not named the third-party product.

The pattern matters for every custodian. Key management is only one control point. When an attacker can inject commands that the signing pipeline treats as authorized, the keys never need to leave secure storage for funds to move. The Bitget account describes a compromise of the systems that decide what gets signed, not of the keys that sign.

Attribution remains unconfirmed

Chen has said Bitget believes North Korean hackers were responsible. She cited IP addresses consistent with VPN choices used by a "certain DPRK group," patterns resembling earlier North Korean operations, and on-chain signatures. No technical evidence has been made public. Bitget's own incident page does not name a responsible group and describes the attack only as a "highly sophisticated targeted attack." Chen also told reporters the company did not currently believe it was an inside job, though investigators had not completely ruled out employee involvement (Hackread).

Laundering and recovery

On-chain researchers tracked rapid movement of the stolen assets. One newly created wallet spent $19.67 million in USDT0 to buy 7,111 ETH within six minutes, paying roughly 5% above market through UniswapX and 1inch Fusion. Tagged wallets moved funds across at least five blockchains, and the largest single component was about 103 million XRP, worth roughly $157 million at the time (Decrypt via Yahoo Finance). Bitget launched a recovery bounty offering 5% of any funds recovered or frozen, and its incident page lists cooperation with Bybit's LazarusBounty program as a recovery channel.

Customer balances and the protection fund

Bitget says customer balances are unaffected and that its Protection Fund covers the loss. Its own disclosures are inconsistent on the fund's size. The incident page headline gives "$314M+" held as 3,705 BTC. Its FAQ cites 5,500 BTC, or more than $464 million. A separate timeline entry for September 30 says the fund had been replenished to over $300 million. The page does not report any specific disbursement from the fund.

What to watch

Bitget's own formal security report is the key outstanding item. It should identify the third-party product, explain how high-privilege credentials were obtained, and describe what changed in Bitget's withdrawal authorization path. Whether law enforcement or blockchain analytics firms publish attribution evidence, and how much of the laundered funds can be frozen, will determine how much of the loss is ultimately recovered.