Unauthorized users gained access to the wallet backend systems of the Bitget exchange after leveraging a vulnerability in an external security tool. CEO Gracy Chen reported that attackers stole internal credentials and ran two test transfers below risk thresholds 30 minutes before draining hot wallets, resulting in a $387.5 million loss. The intruders erased traces of their commands and bypassed risk controls, though Chen stated that cold wallets and private keys were not compromised.

Bitget is now restructuring access to sensitive systems and requiring multiple approvals for critical operations, with all withdrawal requests facing independent verification. The exchange has resumed phased withdrawals, starting with Bitcoin on the mainnet and BSC, with all other assets available by Oct. 2. The company previously noted its Protection Fund will cover all losses and be restored to over $300 million within a week, while analyst ZachXBT reported that Chinese operatives are laundering the stolen funds for alleged North Korean attackers.