Bitget Details $388 Million Security Incident as BTC Withdrawals Resume

utoday09-28 13:16

Bitget CEO Gracy Chen has provided further details about the security incident that affected the exchange on Sept. 24, saying the attacker exploited a vulnerability in a third-party security product ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2671251469?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-09-28 13:16","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2671251469","market":"sh","top_or_hot":-1,"title":"Bitget Details $388 Million Security Incident as BTC Withdrawals Resume","media":"utoday","content":"<div>\n<p>Bitget CEO Gracy Chen has provided further details about the security incident that affected the exchange on Sept. 24, saying the attacker exploited a vulnerability in a third-party security product ...</p>\n\n<a href=\"https://u.today/bitget-details-388-million-security-incident-as-btc-withdrawals-resume\">Source Link</a>\n\n</div>\n","source":"utodaynews_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Bitget Details $388 Million Security Incident as BTC Withdrawals Resume</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBitget Details $388 Million Security Incident as BTC Withdrawals Resume\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-09-28 13:16 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://u.today/bitget-details-388-million-security-incident-as-btc-withdrawals-resume><strong>utoday</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Bitget CEO Gracy Chen has provided further details about the security incident that affected the exchange on Sept. 24, saying the attacker exploited a vulnerability in a third-party security product ...</p>\n\n<a href=\"https://u.today/bitget-details-388-million-security-incident-as-btc-withdrawals-resume\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"ARKY","symbol_name":"ARK Active Autocallable Income ETF","start_time":0,"source_url":"https://u.today/bitget-details-388-million-security-incident-as-btc-withdrawals-resume","article_id":"2671251469","we_media_id":null,"thumbnails":[],"rights":{"source":"utodaynews_highlight","url":"https://u.today/bitget-details-388-million-security-incident-as-btc-withdrawals-resume","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2671251469","pubTimestamp":1790572560,"columns":[],"sourceInfo":{"source_id":"utodaynews_highlight","name":"u.today"},"weMediaInfo":null,"summary":"Bitget CEO Gracy Chen has provided further details about the security incident that affected the exchange on Sept. 24, saying the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials.During a public livestream on X, Chen said the attacker subsequently used those credentials to send fraudulent withdrawal commands to Bitget's wallet system. The commands triggered abnormal transfers that bypassed existing risk controls.\"Our investigation has found that the attacker exploited a vulnerability in a third-party security product to obtain the high-level internal credentials,\" Chen said. \"And then the attacker used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls.?","collect":0,"end_time":0,"defaultTopTitle":"u.today","property":[],"viewcount":null,"language":"en","relate_stocks":{"ARKY":"ARK Active Autocallable Income ETF","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","FBTC":"比特币ETF-Fidelity","BETE":"等权重比特币&以太币期货ETF-ProShares","MSBT":"Morgan Stanley Bitcoin Trust ETP","BITC":"Bitwise Trendwise Bitcoin and Treasuries Rotation Strategy ETF","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","EZBC":"比特币ETF-Franklin","BETH":"比特币&以太币期货ETF-ProShares","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","BTC":"Grayscale Bitcoin Mini Trust","YBIT":"YieldMax Bitcoin Option Income ETF","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF","ETHE":"最大以太坊ETF-Grayscale","BRRR":"比特币ETF-CoinShares","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","SBIT":"2倍做空比特币期货ETF-Proshares","XRP":"Bitwise XRP ETF","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","BTC.AU":"Btc Health Ltd","BTCI":"NEOS Bitcoin High Income ETF","HODL":"比特币ETF-VanEck","BTF":"比特币&以太币期货ETF-CoinShares","NEAR":"iShares Short Duration Bond Active ETF","MNRS":"GRAYSCALE BITCOIN MINERS ETF","BTFX":"比特币期货ETF-CoinShares","MAXI":"比特币期货ETF-Simplify","YBTC":"比特币看涨期权ETF-Roundhill","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","ETU":"T-Rex 2X Long Ether Daily Target ETF","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","BITW":"Bitwise 10 Crypto Index ETF","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","BTGD":"STKD Bitcoin & Gold ETF","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","BITX":"2倍比特币期货ETF-Volatility Shares","BTCO":"比特币ETF-Invesco Galaxy","BCCC":"Global X Bitcoin Covered Call ETF","ETHV":"以太坊ETF-VanEck","OOQB":"One+One Bitcoin and Ether ETF","IBIT":"比特币ETF-iShares","QETH":"以太坊ETF-Invesco Galaxy","BTRN":"比特币期货ETF-Global X","GRAM":"Gold Flora Corporation","STCE":"Schwab Crypto Thematic ETF","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July"},"translate_title":"随着 BTC 提款恢复，Bitget 详细介绍了 3.88 亿美元的安全事件","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BTFX":1.5,"MAXI":1.5,"CBXA":0.6,"FBTC":0.6,"BTCZ":1.5,"EZBC":0.6,"CRPT":1.5,"BTCI":1.5,"XBTY":0.6,"YBIT":1.5,"NCIQ":1.5,"XRP":0.73,"CBXY":0.6,"BTC.AU":1,"CBTJ":1.5,"OOQB":1.5,"BETE":1.5,"ARKY":1.5,"BRRR":1.5,"GRAM":1,"IBIT":1.5,"BITX":1.5,"MSBT":1.5,"XBTmain":1.5,"ETQ":0.6,"ETU":0.6,"BETH":1.5,"HODL":0.6,"BITC":0.6,"BTF":1.5,"STCE":1.5,"YBTC":1.5,"BEGS":1.5,"NEAR":1,"CBTY":0.6,"BTCmain":1.5,"BTCO":0.6,"QETH":0.6,"MNRS":1.5,"BTCL":1.5,"BCCC":0.6,"ETHV":0.6,"BTRN":1.5,"BITW":0.63,"BTC":1,"BTGD":1.5,"ETHE":0.6,"SBIT":0.6},"content_text":"Bitget CEO Gracy Chen has provided further details about the security incident that affected the exchange on Sept. 24, saying the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials.During a public livestream on X, Chen said the attacker subsequently used those credentials to send fraudulent withdrawal commands to Bitget's wallet system. The commands triggered abnormal transfers that bypassed existing risk controls.\"Our investigation has found that the attacker exploited a vulnerability in a third-party security product to obtain the high-level internal credentials,\" Chen said. \"And then the attacker used these credentials to send fraudulent withdrawal commands to the wallet system, causing it to execute abnormal transfers that bypassed risk controls.?\n\nHOT Stories\n\n\n\n    XRP Headlines Altcoins Ahead of Busy Macro Week, Binance's New Listing Live with SpaceX Campaign: Main Crypto News This Morning\n\n\n    XRP, Gram (GRAM), Near Protocol (NEAR) and Bitcoin (BTC) Price Analysis for September 28: Outstanders Stay Relevant\n\n\nBitget said its private keys were not compromised and that its cold wallets were not affected. The exchange has identified the attack path, remediated the vulnerability and contained the incident. It said no further unauthorized transfers had been identified after containment.What happened The initial unauthorized transfers began at about 18:31 UTC on Sept. 24, according to Chen. The attacker first made two relatively small transactions, transferring 0.84 ETH from an Ethereum hot wallet and 93 TRX from a Tron hot wallet. Bitget said both transactions fell below its risk-control threshold and did not trigger an alert.Between 18:58 and 20:09 UTC, the attacker initiated 17 larger transfers involving Ethereum, XRP, Zcash, BNB Smart Chain, Base, Arbitrum, Optimism and Avalanche. Their combined estimated value was about $361 million.Bitget's monitoring systems detected a significant discrepancy at 19:05 UTC, seven minutes after the first large transfer. The exchange then automatically blocked user-initiated withdrawals across the platform.Bitget activated its highest-level P0 emergency response at 19:14 UTC, while its technical team began containment measures at 19:40 UTC. At about 20:40 UTC, the wallet team began moving funds into cold storage as a precaution while it assessed whether private keys had been compromised.The attacker then initiated another seven transfers between 20:55 and 21:23 UTC involving Avalanche, XRP, Ethereum, Zcash, Algorand, TIA and Cosmos. Bitget estimated the value of this second wave at about $30 million.At approximately 21:44 UTC, Bitget shut down wallet withdrawal services, including its signing service, and isolated withdrawal-related inbound and outbound access.The exchange said its security team identified the root cause within several hours and subsequently reported the incident to law enforcement in the jurisdiction where its relevant entity is based.Bitget has confirmed that approximately $388 million in assets were transferred during the incident. The exchange said the figure reflects its latest reconciliation and classification of transactions associated with the attack.According to Chen, the incident was the first security event of this nature to affect Bitget Exchange during its eight years of operation.Forensic investigation continues Chen described the attack as a targeted operation in which the attacker used legitimate credentials and attempted to remove evidence of the activity.“Along the way, they used legitimate credentials. They disguised their activity as routine administrative operations while removing traces of their actions,” Chen said. “This is a sophisticated targeted attack.”According to Bitget, the attacker gained access to an internal management system through the third-party vulnerability, used the compromised credentials to insert fraudulent withdrawal commands into wallet-related backend services and subsequently deleted traces of those commands.Chen said Bitget does not currently believe the incident was an inside job, but added that the company would not speculate about the attacker's identity before the investigation reaches a confirmed conclusion.Forensic firms Mandiant and SlowMist are supporting the investigation, including analysis of the attack vectors, validation of containment and remediation measures, and on-chain asset tracing.Bitget is also working with law enforcement, other exchanges, blockchain projects, on-chain security specialists and other industry participants to trace and recover the affected assets. The exchange said some assets have already been frozen through these efforts and has published identified attacker addresses and relevant tracing data to support industry cooperation.Bitget expects to complete its official security report this week and said additional findings will be disclosed as they are verified.Withdrawals resumeMeanwhile, the exchange has begun a phased restoration of withdrawal services. BTC withdrawals on the Bitcoin and BSC networks resumed at 08:00 UTC on Sept. 28.As of 09:00 UTC, Bitget said users had initiated 9,585 BTC withdrawals, totaling 4,098.03574 BTC. The exchange reported that the withdrawal service was operating normally at that time.ETH withdrawals are scheduled to resume on Sept. 29, followed by USDT withdrawals on Sept. 30. Other supported tokens, fiat withdrawals and P2P services are scheduled to resume on Oct. 2. Availability will be shown directly on the Bitget platform.Chen said BTC was prioritized because its withdrawal pipeline had completed the necessary security checks and the Bitcoin network itself was not affected by the incident. Other networks and assets will be restored after completing their respective security reviews.Bitget said users will not need to take additional steps once individual services are restored. Existing minimum withdrawal amounts and 24-hour maximum limits will remain in place.Chen also said the temporary withdrawal suspension was a security measure rather than an indication of insufficient user assets.“The temporary pause is just a security measure. It's not related to the sufficiency of users' assets because the assets are fully recovered or fully covered by the Bitget Protection Fund,” she said.Bitget said user account balances were not affected and that losses from the incident would be covered by its User Protection Fund. The fund currently exceeds $464 million, according to the exchange.Chen said Bitget established the fund in 2022 and would use it to cover the losses before replenishing it with company capital. She said the fund would be restored to more than $300 million in USDT or equivalent assets within a week of being used.The exchange also reported a comprehensive Proof of Reserves ratio of 127%. Bitget said the reserve ratio and User Protection Fund are separate measures, with the former representing its reported reserves relative to covered user liabilities.Following the incident, Bitget said it has strengthened its assessment and deployment standards for third-party security products, as well as internal access controls, withdrawal verification and abnormal-activity monitoring. The company also plans to introduce stronger independent verification for withdrawals.Alongside the withdrawal restoration, Bitget has launched two limited-time programs. The Bitget Alliance Program for eligible users runs from Sept. 28 at 08:00 UTC through Oct. 26 at 08:00 UTC and allows participants to share in transaction fees generated through eligible trading activity.Project Stand Together targets eligible PRO clients and market makers, offering special project fee discounts and extended PRO-level protection. Preferential rates are scheduled to run from Sept. 28 at 10:00 UTC through Oct. 30 at 09:00 UTC, while the extended PRO-level protection will remain in place through Nov. 30 at 09:00 UTC.Chen said Bitget would continue publishing information about the investigation, remediation measures, withdrawal restoration and asset recovery as the relevant findings are verified.\"This incident is obviously a very serious test for Bitget. We will face it directly,\" Chen said. \"We want to learn from it and we will not let it define us.\"She added that the exchange intends to make its response available for scrutiny by users and the wider industry, including through further disclosures about what happened and the changes implemented afterward.","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.50.1","shortVersion":"4.50.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2671251469","isCrawlerRequest":true}