CRYPTOCURRENCY exchange Bitget resumed Bitcoin withdrawals at 08:00 UTC on 28 September, four days after unauthorised transfers worth approximately $387.5m were made from parts of its hot- and warm-wallet infrastructure. The exchange initially estimated the loss at $351.6m, but increased the figure after identifying additional affected Zcash and TRON transactions. Bitget said this did not represent further transfers after the incident was contained. It said cold wallets and user account balances were unaffected, while trading and deposits continued during the withdrawal suspension.
Bitget said a flaw in a third-party security product gave the attacker high-level internal credentials. These were allegedly used to issue fraudulent withdrawal commands that bypassed the exchange’s risk controls. The company said it had identified and fixed the vulnerability, and that private keys had not been compromised based on its investigation to date. Mandiant and SlowMist are assisting with forensic analysis and fund tracing, while Bitget said some assets had already been frozen.
The exchange said the loss was covered by its Protection Fund, valued at more than $464m in its initial incident notice, and has launched a recovery bounty programme.
Further services are scheduled to return in stages: Ether withdrawals on 29 September, selected Tether withdrawals on 30 September, and other tokens, fiat withdrawals and peer-to-peer services on 2 October. Bitget said the incident remains contained, but its investigation has not concluded, so the attacker’s identity and the full extent of the compromise remain unknown.