Bitget Blames $388M Hack on Third-Party Security Flaw

A major crypto exchange lost hundreds of millions of dollars — but its CEO says the weakness that let it happen came from outside the company.

Bitget, a crypto exchange (an online platform where people buy, sell, and store digital coins), suffered a $388 million hack last month. The company's CEO, Gracy Chen, has now explained how it happened.

What went wrong?

According to Chen, the attacker found a weakness in a third-party security product (a security tool made by another company, not by Bitget itself). This let the hacker steal "high-level internal credentials" — essentially, powerful digital login access. With that access, the attacker sent fake withdrawal orders to move money out.

Importantly, Chen stressed that:

• Bitget's private keys (secret codes that control access to crypto funds) were not stolen.
• Its cold wallets (offline storage that hackers can't reach through the internet) were safe.
• The theft came from hot wallets (online wallets connected to the internet for fast transactions).

• Date of attack: Sept. 24
• Amount stolen: ~$388 million (first estimated at $352 million)
• Withdrawals were temporarily paused after the breach was detected.

Bitget says it has closed the security gap and added stronger protections, including limiting internal access, requiring extra checks before withdrawals, and boosting monitoring for suspicious activity.

Recovering the money

Some stolen funds have been frozen (blocked so they can't be moved) with help from other companies in the industry. However, Bitget hasn't said exactly how much has been recovered. It also asked THORChain — a service that swaps crypto between different blockchains — to block the hacker's addresses, but THORChain says its decentralized design makes that technically impossible.

Who did it?

Bitget earlier suspected North Korea may be behind the attack, based on early clues like IP addresses. Chen says this is still being investigated by security firms Mandiant and SlowMist.

Bottom line: Bitget insists its core systems held strong, but this hack is a reminder that even trusted platforms can be attacked through outside tools.

This is an AI-generated summary. Read the original article at: https://cointelegraph.com/news/bitget-388m-hack-third-party-security-vulnerability?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound