Bitget has traced the cause of a recent $388 million exploit to a weakness in a third-party security product, according to the exchange’s CEO Gracy Chen. In an interview with Cointelegraph, Chen said the attacker gained access to “high-level internal credentials” and then used them to send fraudulent withdrawal requests.
Chen emphasized that Bitget’s private keys were not compromised and that its cold wallets were not affected. She added that the exchange has already fixed the underlying security flaw and tightened withdrawal procedures, including stricter internal access controls, additional independent withdrawal verification, and increased monitoring for unusual activity.
Key takeaways
- Bitget says the exploit relied on compromised “high-level internal credentials” tied to a third-party security product vulnerability.
- According to CEO Gracy Chen, Bitget’s private keys and cold wallets were not compromised.
- Bitget detected unauthorized transfers from multiple hot wallets on Sept. 24 and temporarily suspended withdrawals.
- The exchange has not published recovery or freezing totals and plans to disclose figures only after verification.
- Bitget has coordinated with other participants to freeze some assets, and it has discussed how to handle related swaps with THORChain.
What Bitget says happened during the exploit
Cointelegraph reports that the attack occurred on Sept. 24, after Bitget noticed unauthorized transfers originating from several of its hot wallets. In its initial assessment, the exchange estimated that roughly $352 million worth of assets had been affected. Following the detection, Bitget temporarily suspended withdrawals as it worked to contain the incident.
Chen’s explanation focuses on the pathway the attacker took after obtaining access. She told Cointelegraph that the vulnerability in a third-party security tool enabled the attacker to acquire high-level internal credentials. With those credentials, the attacker reportedly issued fraudulent withdrawal commands—an important distinction that suggests the breach may have been more about authorization misuse than direct theft of cryptographic keys.
To reassure customers, Chen stated that Bitget’s private keys were not compromised and that cold wallets were not impacted. She also said Bitget has since addressed the security flaw and strengthened withdrawal controls, including limiting internal access, adding independent verification for withdrawals, and improving monitoring for atypical activity patterns.
Recovery remains unquantified as Bitget verifies freezes
One of the biggest open questions for affected users is how much of the stolen funds can ultimately be recovered or rendered unusable. Bitget has not yet disclosed recovery figures or the amount it believes has been frozen.
Chen told Cointelegraph that some assets have been frozen with assistance from other industry participants. However, Bitget said it will only release a consolidated total after it finishes verifying the amounts. That approach matters because frozen amounts can be difficult to measure accurately during fast-moving incidents, especially when funds move across addresses or are split across multiple transactions.
Bitget’s decision not to provide a public number yet suggests the exchange is prioritizing confirmation over estimates—an area where earlier-stage reporting has often become contentious in past hacks, as totals can change quickly once investigators understand how funds were routed.
Withdrawal freezes vs. decentralized swap constraints with THORChain
Bitget previously urged THORChain, a cross-chain swapping protocol, to refuse services to addresses associated with the attack. Chen said Bitget is not asking THORChain to halt its network entirely while the response continues, but rather attempting to reduce the ability for stolen assets to be converted or routed further.
THORChain has said it cannot selectively blacklist individual addresses, and Chen reiterated that position. She told Cointelegraph that Bitget understands THORChain is decentralized and that the protocol cannot selectively block particular addresses due to technical constraints.
Chen also stressed that Bitget is not seeking actions that would be impossible on-chain. This highlights a common tension in incident response: centralized platforms may be able to freeze assets or restrict withdrawal flows, while decentralized infrastructure typically cannot implement ad hoc blacklists without changing fundamental protocol behavior.
For users tracking the hack, the practical implication is that response efforts may hinge on what can be blocked at the exchange level, what can be frozen through counterparties, and what remains ungovernable via decentralized liquidity routes.
Investigation into attribution: initial indicators still under review
Chen also addressed Bitget’s earlier suggestion that North Korea could be behind the attack. In comments to Cointelegraph, she said the earlier claims were based on preliminary indicators observed during the investigation.
She added that those indicators are still being assessed, and that Mandiant and SlowMist are supporting an independent forensic effort. Chen said Bitget will share further findings once they are verified.
This staged attribution approach is notable: many high-profile cyber incidents involve fast-moving hypotheses that later require confirmation. By framing earlier reporting as preliminary and emphasizing ongoing independent forensics, Bitget is signaling that any final attribution will depend on the outcomes of technical analysis rather than early, incomplete signals.
Bitget’s response so far—pinpointing a third-party security product vulnerability, emphasizing that private keys and cold wallets were not compromised, and rolling out withdrawal control upgrades—provides a clearer picture of the breach mechanism. Still, customers and observers will want to watch for two things next: whether Bitget’s verified recovery and freeze totals change as investigations conclude, and how the forensic process ultimately informs (or revises) attribution claims.
