Bitget says its system approved a $387.5 million theft

Bitget confirmed that attackers stole $387.5 million from its exchange wallets on September 24. Bitget said its security systems detected unauthorized transfers at 18:31 UTC. The breach affected parts of its hot and warm wallets. Bitget said its offline cold wallets remained secure. The detection time does not establish when attackers first gained access. At 19:57, analyst DCF GOD flagged a wallet spending $19.67 million in USDT0 to buy 7,111 ETH within six minutes. The wallet reportedly paid up to 5% above market prices. Bubblemaps reported roughly $180 million moving from Bitget wallets to a common receiving address by 21:06. Chen's security notice initially put the loss at $351.6 million. Bitget paused withdrawals. Chen said attackers compromised a critical backend system. Chen said the attackers supplied false transaction data and triggered Bitget's authorization process. Bitget's system then approved fraudulent transfers. Chen said investigators had ruled out private-key theft. The method used to enter the backend remains undisclosed. Mandiant and SlowMist are investigating. Bitget revised the loss estimate to $387.5 million after including affected Zcash and TRON assets. Bitget says it fixed the vulnerability. Bitget promised to announce a withdrawal plan by September 26 at 04:00 UTC. Bitget did not commit to reopening withdrawals at that time. Chen cited IP behavior and blockchain activity consistent with North Korean groups. The similarities with the February 2025 Bybit theft support further investigation. They do not independently identify Bitget's attackers. Withdrawals remain suspended, and Bitget says its protection fund covers the loss.