Bitget attacker tested risk controls with small transfers before $388 million theft, CEO says

The attacker behind Bitget's $388 million exploit ran two small test transfers half an hour before draining the exchange, according to CEO Gracy Chen.

In an interview with The Block's Gareth Jenkinson, Chen said the first unauthorized transfers happened at 6:31 p.m. UTC on Sept. 24, including 0.184 ETH from an Ethereum hot wallet and 193 TRX from a Tron hot wallet. Both sat below the exchange's risk-control threshold and triggered no system alerts.

About 30 minutes later, the attacker began making larger transfers. Chen said 17 transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism, and Avalanche between 6:58 p.m. and 8:09 p.m. totaled about $361 million in cryptocurrency.

Bitget’s reconciliation system detected a significant discrepancy within seven minutes of the first large transfer, at 7:05 p.m., and its risk system blocked platform-wide user-initiated withdrawals, according to the CEO.

How the attacker gained access

But the attacker had already gained access to an internal management system by exploiting a zero-day vulnerability in a third-party security product, Chen noted. This allowed them to insert fraudulent withdrawal commands directly into wallet-related backend systems, causing them to be treated as legitimate.

The attacker then deleted traces left by the fraudulent commands, Chen said, complicating Bitget's effort to establish what happened.

"It's also, in my opinion, the trickiest part," Chen said, referring to the deletion of traces.

Bitget has said private keys and cold wallets were not compromised. The exchange is working with Mandiant and SlowMist on its investigation and expects to publish a formal incident report this week.

On attribution, Chen said: "It's still the same group of people that we suspect," declining to name them until the incident report is published.

Bitget's user protection fund, worth $465 million on Sept. 25, will absorb the loss. Chen said it will be replenished to at least $300 million within a week from corporate reserves, which stood at over $1.4 billion as of an Aug. 31 audit.

"An incident like this scale is very serious," Chen said. "But serious doesn't mean existential."

Meanwhile, BTC withdrawals resumed Monday and processed more than 3,000 BTC in the first hour. ETH withdrawals open Sept. 29.