Bitget CEO says $388 million exploit stemmed from a third-party flaw

Bitget CEO Gracy Chen said the $388 million exploit stemmed from a vulnerability in a third-party security product. Chen said the vulnerability allowed the attacker to obtain high-level internal credentials. The attacker used those credentials to issue fraudulent withdrawal commands. Chen said Bitget's private keys were not compromised. Chen said Bitget's cold wallets were not affected. The attack occurred on Sept. 24. Bitget detected unauthorized transfers from several hot wallets. Bitget temporarily suspended withdrawals. The exchange initially estimated that about $352 million in assets had been affected. Bitget said it addressed the security flaw. Bitget said it restricted internal access. Bitget said it added independent verification for withdrawals. Bitget said it increased monitoring for unusual activity. Bitget has not disclosed how much of the stolen crypto has been recovered or frozen. Chen said some assets had been frozen with help from other industry participants. Chen said Bitget would release a total only after verifying the amounts. Bitget previously called on THORChain to refuse services to addresses linked to the attack. Bitget said it was trying to prevent the stolen assets from being moved. Bitget said it was not asking THORChain to halt its network. THORChain has said it cannot selectively blacklist individual addresses. Chen said Bitget respected the technical constraints of different networks. Chen said Bitget was not asking any protocol to take actions that were not technically possible. Chen said Bitget's earlier suspicion that North Korea may have been behind the attack was based on preliminary indicators identified during the investigation. Chen said those indicators were still being assessed. Chen said Mandiant and SlowMist were supporting the independent forensic investigation. Chen said the investigation was ongoing. Chen said Bitget would share further findings as they were verified.