Bitget Details Security Incident Timeline, Report Due This Week
The exchange said unauthorized transfers moved about $388 million across multiple networks on Sept. 25 before services were isolated and deposits reopened.
Bitget disclosed a detailed timeline of its Sept. 25 security incident, saying unauthorized transfers worth about $388 million were made across multiple blockchain networks and that a formal investigation report will be published this week.
The exchange said attackers initiated 17 large transfers worth about $360 million across networks including Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum and Optimism. A second wave of seven transfers on networks including Avalanche moved about $28 million.
Bitget said its reconciliation system detected a major discrepancy during the incident, prompting its risk controls to block user withdrawal requests. The exchange later halted wallet withdrawal services and isolated incoming and outgoing activity while funds were consolidated into cold wallets.
Bitget’s security team said attackers used a zero-day vulnerability in a third-party security product to steal internal credentials, enter key management systems and inject forged withdrawal instructions. The company said private keys were not exposed and cold wallets were unaffected.
Deposits reopened around midday Sept. 26 after vulnerability fixes, service isolation and security checks. Bitget said Bitcoin withdrawals will open Sept. 28, with Ether, Tether and fiat services expected to resume over the following days. The formal investigation report is due this week.
