Bitget Resumes Withdrawals After $388 Million Hack Exploiting Third-Party Zero-Day Flaw

Cryptocurrency exchange Bitget has begun a phased resumption of customer withdrawals, ending a four-day freeze following a $388 million theft on September 24. The standard narrative for such a breach involves compromised private keys or breached cold storage vaults, but the exchange has now confirmed a different vector. Attackers exploited a zero-day vulnerability in an unnamed third-party security product to acquire high-level internal credentials. "The attacker then used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls," the exchange stated.[4][5]

The breach began with a quiet probe. At 18:31 UTC on the day of the attack, the perpetrators initiated two small test transfers—0.184 ETH and 193 TRX—that fell below Bitget's risk-control thresholds and triggered no alarms. Half an hour later, the main drain commenced. Over the next several minutes, 17 transactions moved roughly $361 million across multiple networks, including Ethereum, BNB Chain, and Avalanche.[3][4]

Bitget's internal reconciliation systems caught the discrepancy within seven minutes of the first large transfer, automatically halting platform-wide withdrawals at 19:05 UTC. However, the attackers had already successfully routed the funds and subsequently deleted the administrative traces of their commands, complicating the initial forensic response.[3][4]

The exchange initially estimated the damage at $351.6 million, but later revised the total to $387.5 million after identifying additional unauthorized transfers on the Zcash and TRON networks. Bitget maintains that this revision reflects a more complete accounting of the original 30-minute window, rather than a secondary breach.[1][5]

Despite the scale of the theft, Bitget asserts that customer balances will not be affected. The company is drawing on its User Protection Fund—a self-funded reserve holding 5,500 Bitcoin, valued at over $464 million—to absorb the losses in full. The exchange has committed to replenishing this fund to at least $300 million within a week using corporate reserves.[1][4][5]

With the underlying vulnerability reportedly patched, Bitcoin withdrawals restarted on September 28 at 08:00 UTC. The exchange processed over 9,585 withdrawal orders totaling roughly 4,098 BTC in the opening hours. Ethereum withdrawals are scheduled to resume on September 29, followed by Tether (USDT) on September 30, as the security team validates each network route. “Bitget has identified the attack path, remediated the vulnerability, and strengthened controls across its withdrawal infrastructure,” the company explained.[3][4][5]

The identity of the attackers remains unconfirmed. While CEO Gracy Chen initially noted that the attack patterns and IP behaviors strongly resembled those of North Korean state-sponsored hacking groups, she later clarified that these were preliminary indicators. Bitget has retained cybersecurity firms Mandiant and SlowMist to conduct a formal forensic investigation, with a comprehensive incident report expected shortly.[2][4][5]

In an effort to reclaim the stolen assets, Bitget has launched a recovery bounty program, offering a 5 percent reward for information leading to the freezing of funds and another 5 percent for their successful recovery. While centralized stablecoin issuers like Circle and Tether have frozen a small fraction of the assets—roughly $318,000—the vast majority have already been swapped into decentralized cryptocurrencies, making protocol-level intervention technically impossible.[1][3][4]