How Bitget Is Chasing $388 Million in Stolen Funds After a Zero-Day Hack

Bitget said it detected unauthorized withdrawals at 6:31 p.m. UTC on September 24, when test transfers of 0.48 ETH and 93 TRX remained below its risk-control threshold. Attackers began 17 large transfers at 6:58 p.m., moving about $361 million across chains and assets. At 7:05 p.m., reconciliation detected a discrepancy and Bitget blocked user-initiated withdrawals, but that did not stop the attackers: they were using a separate backend mechanism. The last transfer in the initial sequence occurred at 9:23 p.m.

Gracie Chen said the attackers exploited a previously undiscovered zero-day in a third-party security product to enter an internal management system, impersonate an identity, and insert fraudulent withdrawal commands into Bitget’s wallet service. They deleted traces of the commands, delaying the investigation. Chen withheld the vendor’s name and vulnerability details pending Bitget’s incident report. Because the company could not rule out private-key compromise, it temporarily enabled transfers to move hot- and warm-wallet funds into cold storage. Chen said attackers used that window in a second attack from 8:55 to 9:23 p.m., taking about $30 million. The incident involved multiple systems, wallet types, and chains, complicating the investigation.

The interview named Ethereum, XRP, Arbitrum, Avalanche, Optimism, BSC, Base, and Zcash among the affected chains. Chen said Zcash and another chain—she could not recall whether it was TIA or Tron—were identified later because the assets involved were relatively small; she said Zcash’s privacy features did not cause the delay. At the time of the discussion, $632,000 of the $388 million stolen had been frozen. Tether and Circle froze stolen stablecoins, while Near Intents helped freeze about $500,000 in other crypto routed through a swap. A Bitget representative stressed that freezing funds is not the same as recovering them, which requires further legal procedures, and said the recovery effort had made little progress.

Bitget offered a 5% bounty for voluntarily freezing stolen funds and another 5% for voluntary recovery. The company planned to pay contributors who had already helped unless they declined; declined bounty funds could go to nonprofits or NGOs. A representative said Bitget hoped to do better than the 3.5% of Bybit’s more than $1.4 billion stolen that the representative said had been frozen after a year, while acknowledging that Bybit had recovered much less. Chen said Bitget was monitoring laundering and working with decentralized protocols to hinder movement of the funds. Some protocols refused requests to block hacker-linked addresses; others reported freezing accounts and declined a bounty. Bitget had engaged SlowMist and Mandiant and was coordinating with independent on-chain researchers, but its representative said the company had not spoken directly with Zach XBT, formally hired him, or established whether his post about aliases and linked transactions helped freeze or recover funds. Laura Shin said the hack bore hallmarks of DPRK-linked attacks, but the discussion did not identify the perpetrators.

Bitget said it isolated relevant servers and systems, revoked and reissued credentials, and added multiple approvals for critical operations. Chen acknowledged that the company had not done enough checks on third-party services and planned to change its approach, while cautioning that some details could not be disclosed if doing so might expose security systems, staff, or vendors to further threats. Bitget was communicating with law enforcement and regulators, preparing an incident report, and planning security sessions with key clients. Chen said she addressed the community soon after learning of the incident, as outside security researchers were already discussing the on-chain activity.

Bitget’s Protection Fund, established in mid-2022 after smaller exchanges ran out of cash or shut down, had a $300 million minimum threshold, raised from an initial $200 million. The fund was valued at about $556 million, and Bitget said company capital would keep it above the threshold within a week. The company moved some fund assets to its hot wallet to prepare for withdrawals, which were smaller than expected. One hour after Ethereum withdrawals reopened at 8 a.m. UTC, Chen reported 9,674 ETH in inflows and about 9,023 ETH in outflows. She said business had returned to normal but the company still needed to regain users’ trust; the incident had not changed Bitget’s major financial plans, and a potential IPO remained on its roadmap without a confirmed timeline.