Bitget: $388M Heist Ran Through a Flaw in a Third-Party Security Product

Cryptocurrency exchange Bitget has explained how roughly $388 million left its systems: the attacker exploited a vulnerability in a third-party security product the exchange itself relied on. The flaw, the company says, yielded high-level internal credentials, and on September 24 the intruder used them to send fraudulent withdrawal commands to Bitget's wallet system.

Exchanges keep most customer money in offline cold wallets and run withdrawals through hot and warm ones. Transfers from those still need approval before they are signed. The stolen funds came from part of Bitget's hot and warm wallets; the cold wallets were untouched.

How the attack unfolded

Bitget CEO Gracy Chen described the incident in a livestream and in interviews with The Block and Cointelegraph. The flaw gave the attacker access to an internal management system, from which fraudulent withdrawal commands were inserted into wallet-related backend services — and treated as legitimate.

On September 24, at 18:31 UTC, the attacker made two small test transfers. They stayed under Bitget's risk-control threshold and set off no alert. Roughly half an hour later the large transfers began, and the wallet system executed them, bypassing its risk controls.

"Along the way, they used legitimate credentials. They disguised their activity as routine administrative operations while removing traces of their actions," Chen said. No private keys were compromised, according to the investigation so far.

Chen did not name the product, but per The Block she called the flaw a zero-day — a bug attackers exploit before its maker ships a fix.

Response and fallout

Bitget has notified the vendor, isolated the affected systems, revoked and reissued internal credentials, and turned off the vulnerable functionality. Whether the vendor has released a patch is unstated. Mandiant and SlowMist are assisting the investigation, and Bitget expects to publish a formal incident report this week.

Customer balances were not affected; the loss will be covered by the exchange's Protection Fund, a reserve set aside for such incidents. Bitcoin withdrawals reopened Monday, with other assets to follow in stages through October 2; users need do nothing.

Bitget still suspects "the same group of people" it pointed to a week earlier — North Korean hackers — but Chen declined to name the group until the report is out. Analytics firm TRM Labs previously found overlaps between the stolen funds and wallets used to launder earlier North Korean thefts, pointing to the group TraderTraitor without making a firm attribution.

The exchange has published the main receiving addresses and a live tracking dashboard, asking exchanges, stablecoin issuers, bridges and custodians to watch them. TRM Labs advises screening incoming deposits not only for direct transfers from the exploiter's addresses but for funds routed through intermediate wallets, bridges and cross-chain swap services.

Source: The Hacker News