Bitget CEO Gracy Chen says the attacker behind the exchange's $388 million theft ran two small test transfers 30 minutes before the main breach to probe its risk controls. The attacker had already used a zero-day flaw in a third-party security product to plant fraudulent withdrawal commands, and Bitget's own detection system caught the drain within seven minutes.
Small transfers tested the system first
The attacker moved 0.184 ETH from an Ethereum hot wallet and 193 TRX from a Tron hot wallet at 6:31 p.m. UTC on Sept. 24, Chen said. Both transfers sat below Bitget's risk-control threshold and triggered no alerts.
About 30 minutes later, the attacker moved to the real theft. Chen said 17 transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche between 6:58 p.m. and 8:09 p.m. totaled roughly $361 million. Bitget's reconciliation system, however, caught the discrepancy fast: its risk system blocked platform-wide withdrawals just seven minutes after the first large transfer, at 7:05 p.m.
A zero-day opened the door
The attacker had already broken into an internal management system by exploiting a zero-day vulnerability in a third-party security product, according to Chen. That access let them insert fraudulent withdrawal commands directly into wallet backend systems, which treated the commands as legitimate. The attacker then deleted the traces those commands left behind, complicating Bitget's investigation.
According to The Block: "It's also, in my opinion, the trickiest part", Chen said, referring to the deleted traces. She added that private keys and cold wallets were not compromised, and that Bitget is working with Mandiant and SlowMist on a formal incident report due this week. On attribution, Chen said only that it remains the same group Bitget originally suspected, declining to name them.
Fund replenishment and withdrawals resuming
Bitget's user protection fund, worth $465 million on Sept. 25, will absorb the loss. Chen said the fund will be replenished to at least $300 million within a week using corporate reserves, which exceeded $1.4 billion as of an Aug. 31 audit.
Bitcoin withdrawals restarted Monday, and Bitget processed more than 3,000 BTC in the first hour. Separately, Bitget said it had processed 9,585 withdrawal orders totaling 4,098.036 BTC as of 17:00 UTC+8 Monday, with other assets scheduled to return through Oct. 2. Ether withdrawals are set to open Sept. 29.
Sources: The Block, Crypto Briefing
Trading involves risk.
Risk Disclaimer
