Bitget Hackers Exploit Third-Party Security Flaw for $387.5M Heist

A recent cyberattack on Bitget, a crypto exchange, has left the platform reeling. The attackers exploited a zero-day vulnerability in a third-party security product that Bitget had purchased, allowing them to pose as administrators and execute forged withdrawal instructions.

The attack occurred on September 24, with two small test transfers made before the main outflow of $361 million across eight different blockchains. However, it was not until the ledger reconciliation system flagged a discrepancy between recorded and actual balances that Bitget froze withdrawals.

The exchange's CEO, Gracy Chen, described erasing the attack's traces as the 'most delicate part' of the operation. The security firms Mandiant and SlowMist are working to establish what happened.

Bitget has announced a withdrawal schedule, with different networks opening at staggered times. The exchange is absorbing the loss from its protection fund, valued at $465 million on September 25, which will be topped back up to at least $300 million within a week.