Bitget attacker tested controls via small transfers before $388 million theft, CEO says

An attacker carried out a $388 million exploit against Bitget. CEO Gracy Chen said the attacker made two small test transfers before the larger transfers. The first unauthorized transfers occurred at 6:31 p.m. UTC on Sept. 24. One transfer sent 0.184 ETH from an Ethereum hot wallet. Another sent 193 TRX from a Tron hot wallet. Both transfers fell below Bitget's risk-control threshold. Neither transfer triggered a system alert. The attacker began larger transfers about 30 minutes later. Chen said 17 transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche totaled about $361 million in cryptocurrency between 6:58 p.m. and 8:09 p.m. Bitget's reconciliation system detected a significant discrepancy at 7:05 p.m., within seven minutes of the first large transfer. Bitget's risk system blocked platform-wide user-initiated withdrawals. Chen said the attacker gained access to an internal management system by exploiting a zero-day vulnerability in a third-party security product. The attacker used the access to insert fraudulent withdrawal commands directly into wallet-related backend systems, causing the commands to be treated as legitimate. Chen said the attacker then deleted traces left by the commands. Bitget has said its private keys and cold wallets were not compromised. Bitget is working with Mandiant and SlowMist on its investigation. Bitget expects to publish a formal incident report this week. Chen said Bitget suspects the same group of people as before. She declined to name them until the incident report is published. Bitget's user protection fund was worth $465 million on Sept. 25 and will absorb the loss. Chen said Bitget will replenish the fund to at least $300 million within a week using corporate reserves. The reserves stood at more than $1.4 billion in an Aug. 31 audit. Chen called the incident very serious but said it was not existential. BTC withdrawals resumed Monday. They processed more than 3,000 BTC in the first hour. ETH withdrawals are set to open Sept. 29.