Original author: WhiteRunner
In the past few years, it is not uncommon for exchanges to encounter large-scale security incidents, and attack entrances have gradually extended from hot wallets and signature systems to internal permissions and third-party services. As the system becomes more and more complex, the boundaries that exchanges need to defend become larger and larger.
On September 25, Bitget encountered a security incident, and it was finally confirmed that approximately US$388 million in assets were affected. CEO Gracy Chen later said in the live broadcast that this was the first time such a security incident had occurred on the platform in eight years of operation. According to findings published by SlowMist, the earliest malicious activity discovered involved a zero-day vulnerability on the node of a third-party security product. Investigations by Mandiant and SlowMist both pointed to the attack path being compromised in third-party security infrastructure, and ultimately into Bitget’s wallet environment.
After the incident, Bitget announced that the user protection fund would bear the losses. At the time of the incident, the fund, which was established in 2022, held 5,500 BTC, worth more than $464 million. Gracy pledged that the conservation fund would be replenished to $300 million within a week of being used, returning it to the baseline size established when it was established in 2022. On September 30, this promise was fulfilled as scheduled.
Withdrawals have also begun to resume according to the previously announced schedule. BTC first opened withdrawals at 16:00 on September 28. After ETH withdrawals resumed on the 29th, the relevant hot wallets quickly turned from net outflows to net inflows. Soon the balance even slightly exceeded the initial level before withdrawals were opened. Users' trust is returning. As of press time, withdrawals of all currencies have been resumed.
Only a few days passed between the time nearly $400 million was stolen and when withdrawals were restored and funds were flowing in again. How do hackers transfer assets without leaking the private key? How can a conservation fund that has been prepared for four years really come in use? What did Bitget do to cause events to take a turn?
1. Hackers use zero-day vulnerabilities to break into third-party security products
What is special about this attack is that Bitget’s private key was not leaked, the cold wallet was not breached, and it was not a smart contract vulnerability. The breakthrough the hackers found turned out to be a third-party security product used by the platform.
According to the investigation results currently disclosed by Bitget, around 02:31 on September 25, Beijing time, the earliest confirmed related small-amount transfer appeared on the chain, and then larger-scale asset transfers began to occur.
In an interview with The Block, Gracy said that from 02:58 to 04:09, the attacker conducted 17 large transactions through multiple networks including Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche. With the subsequent addition of statistics, Bitget finally confirmed that the incident affected approximately US$388 million in assets.
At 03:05, about 7 minutes after the first large transfer occurred, Bitget's reconciliation system discovered obvious fund discrepancies and triggered a platform-wide withdrawal block; at 03:14, the platform initiated the highest level emergency response. Since the leakage of the private key could not be ruled out at that time, the wallet team subsequently transferred the assets to the cold wallet and closed the wallet withdrawal and signature services.
Subsequently, the security team determined the root cause of the incident. According to the attack chain currently announced, the hacker exploited a previously unknown zero-day vulnerability in a third-party security product.
The so-called zero-day vulnerabilities refer to security flaws that manufacturers and users have not previously understood and for which there are no ready-made patches that can be deployed in advance. In other words, this is a previously unknown attack entry point. What happened next is the key to understanding the nearly $400 million loss.
Taking advantage of this vulnerability, the attacker stole the intranet authority credentials through vulnerabilities in third-party security products, forged withdrawal commands to the wallet system, and deceived the wallet into performing abnormal transfers that bypassed risk verification. During the entire process, the private key was not leaked and the cold wallet was not affected.
Gracy later revealed that the attacker deleted some relevant traces after completing the operation, making it more difficult to investigate and restore the attack process.
Bitget has since deactivated the affected third-party functions, re-issued internal credentials, revoked and re-split highly sensitive permissions, and added independent verification for withdrawals. Mandiant and SlowMist are still involved in independent forensic investigations and money tracing.
A direct warning left by this incident to the industry is that the security boundary of exchanges is no longer just private keys and cold wallets. Security software, wallet infrastructure, and other third-party services with access to core systems can themselves become entry points for attacks.
2. The protection fund began to be used, and withdrawals resumed as scheduled.
After the incident, the next real test of an exchange is who should bear the losses and how the management faces and comforts users.
Bitget first tapped its conservation fund.
The fund was launched in 2022 and has a long-term baseline size of $300 million. At the time of the accident, the fund held 5,500 BTC, worth more than $464 million, which was enough to cover the final recognized loss of approximately $388 million.
Bitget later made it clear that the protection fund would bear the financial impact of this incident, and user account balances would not be affected.
Before BTC withdrawals resumed on September 28, it could already be seen on the chain that protection funds began to allocate assets to hot wallets. On-chain analyst Ai Ai monitored that 2,042.28 BTC were initially transferred from the relevant protection fund address to the Bitget hot wallet (Bitget Protection Fund on-chain monitoring).
This is one of the most worthy industry references for Bitget’s handling.
This protection fund is not a temporary compensation plan announced after the accident, but was established four years ago. The funds are long-term reserves, the wallet address is public and can be checked, and there is a clear scale benchmark; it will be actually used after an accident occurs, and will be replenished according to the original standards after use.
Protection funds solve the problem of loss liability. This time, the nearly $400 million in losses was ultimately not passed on to users. Gracy said that Bitget will replenish the protection fund to at least US$300 million within a week, and judging from on-chain monitoring, it has been fulfilled as scheduled.
Bitget also released the 47th Proof of Reserve (PoR) on September 30, with a total reserve rate of 131%, covering 19 types of assets. Among them, the reserve ratios of BTC, ETH, USDT and USDC are 142%, 110%, 107% and 154% respectively.
In addition to funding, Bitget’s communication style these days is also worthy of attention.
Gracy responded continuously during the live broadcast for the community for about three hours, and Xie Jiayin also continued to update progress through social media and the community. The three-hour live broadcast itself is not the point. What is more important is that during the most chaotic days of the accident, the management was always at the front desk to respond to problems.
Moreover, several key statements basically gave clear information or next steps.
It was soon clear who would bear the loss and it would be covered by the protection fund; after the impact amount was adjusted from US$351.6 million to US$388 million, the reasons for the change in numbers were explained; before the attack entrance was confirmed, there was no rush to draw conclusions about the identity of the attacker and the attack method; after the investigation made progress, details such as third-party security products, zero-day vulnerabilities, high-privilege credentials, and forged withdrawal instructions were gradually announced.
The same goes for withdrawal recovery.
This incident involves multiple currencies and multiple networks, and the scope of the investigation is not limited to one wallet. Bitget did not resume all withdrawals at once, but opened them in batches after confirming the relevant wallets, networks and risk elimination one by one.
On September 26, the platform announced a specific recovery schedule: BTC will be restored on September 28, ETH and related networks will be restored on September 29, USDT and related networks will be restored on September 30, and other tokens, legal currencies, and C2C services are scheduled to resume on October 2. Before going to press, it was verified that everything had been restored as scheduled.
Considering that this is a large-scale security incident involving multiple currencies, multiple networks, third-party software, and internal permissions, it is worthy of recognition that a recovery plan with a specific date and time is given first, and then implemented one by one.
The protection fund is prepared four years in advance and can be used in the event of an actual incident; the management continues to face the community; certain information is released in a timely manner, and uncertain information is not rushed to conclusions; the recovery plan gives a clear time and is implemented according to the time.
This series of clean moves has led many to view Bitget more positively.
3. The turning point of the incident has appeared, and funds have returned to net inflows
After ETH withdrawals resumed on September 29, a noteworthy change quickly occurred on the chain.
According to monitoring by on-chain analyst Ai Ai, the balance of the hot wallet prepared by Bitget for ETH withdrawals returned to more than 30,000 ETH within half an hour after the withdrawal was opened, exceeding the initial value.
Data subsequently released by Bitget showed that in the first hour after withdrawals were resumed, there was an inflow of approximately 9,674 ETH and an outflow of approximately 9,023 ETH, resulting in a net inflow of approximately 651 ETH. Data on September 30 showed that the 24-hour platform capital inflow amounted to US$231 million, which was close to the average daily capital inflow amount of US$245 million in August this year. There was no one-way capital outflow that the market had previously worried about, and instead we can see the market's confidence rebounding.
At the same time, in order to repay users’ trust, Bitget has also begun to launch a number of incentive activities.
Ethereum Pool
BTC PoolX subsequently went online, providing a 100,000 BGB prize pool and giving additional bonuses based on users’ BTC holdings in the previous 15 days.
In terms of stablecoins, Bitget launched USDT and USDGO current financial management activities at the same time, supporting deposits and withdrawals at any time, with limited-time APRs reaching 10% and 12% respectively. The "Peer Plan" will include 30% of the eligible transaction fee income during the event into the user reward pool, of which 60% will be allocated based on transaction volume and 40% will be allocated based on asset volume. On October 2, Bitget official data showed that the first batch of rewards had been distributed, with a total of 1,907,455 USDT distributed to 763,543 users.
The intent of these activities is not difficult to understand. The resumption of withdrawals solves the problem of "whether users can leave", and a series of activities subsequently launched are to restart transactions, financial management and capital accumulation.
Soon, many users voted with their funds, showing confidence in Bitget and enthusiasm for the event.
A few days ago, the market was most concerned about "when can I withdraw money?"; as withdrawals resumed, the question began to become "which activity can you participate in to get a higher APR?"
A signal of an inflection point in events.
For exchanges, the most direct proof of the recovery of user confidence is that they are still willing to keep their money when they can freely enter and exit.
4. What does a safety accident leave to the exchange industry?
After this incident, Bitget received support from almost half of the industry.
The most noteworthy one here is Bybit.
In February 2025, Bybit suffered a security incident of approximately US$1.4 billion. Roughly five hours after the attack, Bitget provided 40,000 ETH to Bybit, which at the time was worth over $100 million. This 40,000 ETH has no interest, no collateral, and no fixed repayment period. Bybit then returned the money in full within three days.
More than a year later, the positions of the two parties were exchanged. After the Bitget incident, Bybit CEO Ben Zhou quickly expressed his willingness to help and specifically mentioned: "Bitget helped us when we were attacked by hackers." Bybit then included the relevant stolen funds into the LazarusBounty system for tracking.
It’s not just Bybit that’s stepping up. CZ publicly expressed support after the incident, and the Binance security team subsequently cooperated with Bitget, including sharing threat intelligence, tracking stolen funds, and supporting asset recovery; MEXC CEO Vugar Usi also proactively contacted Bitget to express support. Outside of the exchange, Mandiant and SlowMist are involved in investigation and evidence collection, while Circle and Tether are involved in freezing related assets.
When I saw these news, my blood really boiled.
The crypto industry never lacks competition. Exchanges compete for users, liquidity, and market share, but when they encounter a security crisis of hundreds of millions of dollars, peers will stick together for warmth.
As for whether Bitget as a platform has truly won trust and respect in the industry, it is most obvious in times of crisis.
But if we only stop at "a friend in need is a friend indeed", we underestimate its significance.
There is no unified organization in the crypto industry, but protection funds, peer collaboration, security agencies and on-chain tracking are forming their own risk management network. At the same time, from hot wallets and signature systems to third-party software and internal permissions, the boundaries that exchanges need to defend are becoming larger and larger: attacks are becoming more and more complex, and the industry needs to work together to deal with them.
The establishment of a protection fund, maintaining openness and transparency after the event, following commitments, and industry cooperation are now excellent paradigms for responding to crises, and Bitget has now carefully demonstrated it.
The crypto industry has been talking about Mass Adoption for the past two years. ETFs, stablecoins, RWAs and tokenized securities have brought more traditional financial funds in, and the US regulatory framework is gradually being established. To reach this point, the industry needs to prove not only innovation and growth, but also the ability to handle risks.
Bitget spent $400 million this time to test a platform’s sense of responsibility in the face of a crisis. Crisis will not end a platform, responsibility can redefine a platform.
For the crypto industry, which is moving towards mainstream finance, this is also an exam that must be passed. No financial system can be built on the assumption that nothing will ever happen. If something goes wrong, whether you can afford compensation, explain things clearly, and recover will test your responsibility and bottom line.
How the financial world ultimately views the crypto industry may depend on how well it responds to a bad day.