The cryptocurrency exchange lost approximately $388 million after hackers used internal credentials to bypass risk controls and execute fraudulent transfers, CEO Gracy Chen announced on September 28. The attackers exploited a zero day vulnerability in a third party security tool to access wallet backend systems and delete traces of the transfers, moving a single chunk of $185 million in one minute. Chen stated during a livestream that private keys were not compromised and an inside job had been preliminarily ruled out.

Bitget has begun restoring asset withdrawals in phases following a four day freeze, with Bitcoin services resuming on September 28 and all other assets scheduled to be available by October 2. The platform has processed 4,098 BTC withdrawals and will replenish its security protection fund to above $300 million within a week. User balances remain unaffected, with Chen confirming all losses are covered by the protection fund regardless of whether the stolen assets are recovered.