$388M Hack Hits Bitget Exchange as Hackers Exploit Security Vulnerabilities

Bitget CEO Gracy Chen explained how hackers exploited vulnerabilities in the exchange's security system to steal $388 million. The attack began on September 24 when two small transfers were made, which did not trigger any alarms because they fell below the risk controls' threshold. These initial attempts were made at 21:31 (Turkey time) with 0.184 ETH from an Ethereum hot wallet and 193 TRX from a Tron hot wallet.

About half an hour later, larger amounts began leaving the exchange through eight blockchain networks, including Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism, and Avalanche. Between 21:58 and 23:09 (Turkey time), approximately $361 million was moved in 17 transactions.

Bitget's reconciliation system detected a significant discrepancy seven minutes after the first large transfer, at 22:05 (Turkey time). The platform then blocked user-initiated withdrawals across the board. However, the attacker had already gained access to the internal management system and inserted fraudulent withdrawal commands directly into the wallet infrastructure.