Bitget CEO Gracy Chen said the attacker behind the exchange's $388 million hack struck in two rounds, with the second wave taking about $30 million between 8:55 and 9:23. The loss came after the exchange turned transfers back on to move hot and warm wallet funds into cold wallets, giving the attacker another opening. "But we needed to do that, because there were far more than $30 million on the hot and the warm wallet that we needed to rescue," Chen said.

The platform's reconciliation system detected a significant discrepancy seven minutes after the first large transfer, and the risk system automatically blocked all user withdrawals at 7:05. The block did not stop the attacker, Chen said, because the fraudulent withdrawals ran through backend servers rather than the normal user withdrawal path. The attacker had exploited a zero-day vulnerability in a third-party security product to obtain internal credentials, inserted fraudulent withdrawal commands that bypassed risk controls, and deleted traces of the transfers. Private keys and cold wallets were not compromised, an inside job has been preliminarily ruled out, and Chen believes a group linked to North Korea carried out the September 24 theft. She said an incident report would be published soon.

Bitget has restored withdrawals in phases since September 28, starting with BTC, followed by ETH on September 29 with a net inflow of 651 ETH in the first hour, and USDT scheduled for September 30. Customers withdrew a net $463 million in the 24 hours after withdrawals resumed. Chen has said lost funds are fully covered by the exchange's Protection Fund, which she pledged to replenish above its $300 million baseline within a week. Blockchain investigator ZachXBT said Chinese illicit actors laundering the funds for the alleged North Korean attackers are openly seeking help with orders on Discord and Telegram while moving the money across bridges and into mixing services such as Wasabi. NEAR Intents said its SHIELD risk system blocked more than $50 million in attempted flows and waived its share of the recovery bounty, and Tether and Circle helped freeze some stolen stablecoins.