Overview
- The intrusion exploited a vulnerability in a third‑party security product that let attackers spoof internal withdrawal approvals, and the breach was first detected on Thursday, September 24.
- On‑chain investigators revised Bitget’s loss to about $387.5 million–$388 million after tracing unauthorized transfers across Ethereum, BNB Chain, TRON, XRP Ledger and Zcash.
- Bitget began a phased restart of withdrawals starting September 28 and processed 9,585 Bitcoin orders totaling roughly 4,098 BTC while users pulled large sums including 3,326 BTC in the first hour and about $463 million in net outflows in 24 hours.
- The company says customer balances are intact because its User Protection Fund covered the shortfall and will be replenished, though CEO Gracy Chen warned that most stolen funds may be unrecoverable.
- Forensic firms Mandiant and SlowMist are tracing laundered funds as services respond unevenly: NEAR Intents’ SHIELD says it blocked over $50 million in attempts, Circle and Tether froze about $318,000, and THORChain refused requests to blacklist attacker addresses.