Bitget CEO says hacker used third-party flaws in $388 million exploit

Bitget CEO Gracy Chen said a hacker stole $388 million in cryptocurrency last week by exploiting vulnerabilities in third-party products. Chen said the hacker stole internal credentials and used them to send fraudulent withdrawal commands that bypassed Bitget's risk controls. Chen said the hack did not compromise private keys. Chen said the hack did not affect cold wallets. Chen said the incident had been contained. The affected systems were isolated and the vulnerability was remediated. Relevant servers were isolated to prevent further compromise and preserve forensic evidence. Internal credentials were revoked and reissued. Access to highly sensitive systems was restructured. Bitget notified the relevant third-party vendor. Bitget shared details of the vulnerability with the vendor. Bitget disabled the affected functionality pending a fix. Mandiant and SlowMist continue to support the independent forensic investigation and asset-tracing efforts. Chen said Bitget's Protection Fund covers 100% of user funds. The fund is self-funded and holds 5,500 Bitcoin. The Bitcoin is stored in publicly visible wallets. Bitget temporarily halted withdrawals after the hack. Bitget began a phased resumption of withdrawals on Monday, starting with BTC. Ethereum withdrawals are scheduled to resume on Tuesday. USDT withdrawals are scheduled to resume on Wednesday. Withdrawals of other tokens and fiat currencies, along with peer-to-peer trades, are scheduled to resume on Friday.