Bitget chief executive Gracy Chen said a $388 million cryptocurrency exploit was enabled by a vulnerability in a third-party security product, rather than a compromise of the exchange’s private keys or cold wallets.
The attacker allegedly used the flaw to obtain high-level internal credentials and then issue fraudulent withdrawal commands, Chen told Cointelegraph. The incident highlights how security weaknesses outside an exchange’s core custody systems can still be used to authorize large transfers.
How the Bitget attack unfolded
Bitget detected unauthorized transfers from several hot wallets on Sept. 24 and temporarily suspended withdrawals. The exchange initially estimated that approximately $352 million in assets had been affected. Its later estimate put the value of the exploit at $388 million.
Chen said the exchange’s private keys were not compromised and that its cold wallets—offline storage systems generally used to keep assets away from internet-based attacks—were not affected. The stolen assets were moved from hot wallets, which are connected to online systems and used to support transactions and withdrawals.
Bitget said it has fixed the security vulnerability and strengthened its withdrawal process. The measures include tighter limits on internal access, independent verification for withdrawals and expanded monitoring for unusual activity.
Recovery and THORChain response
Bitget has not yet published a total for the cryptocurrency that has been frozen or recovered. Chen said some assets were frozen with assistance from other participants in the crypto industry, but the exchange will release a figure only after the amounts have been verified.
The exchange had asked THORChain, a protocol that enables asset swaps across different blockchains, to refuse services to addresses connected with the attack. Bitget said it was not asking THORChain to stop operating or to take action that the network could not technically perform.
THORChain has said it cannot selectively blacklist individual addresses. Bitget acknowledged that limitation, saying it respected the technical constraints of decentralized networks.
North Korea link remains unconfirmed
Bitget had previously raised the possibility that North Korea was connected to the attack. Chen said that assessment was based on preliminary indicators identified during the investigation, and that those indicators were still being examined.
Mandiant and SlowMist are assisting with an independent forensic investigation. Chen said Bitget would publish additional findings once they had been verified. No confirmed conclusion about the alleged North Korean link was provided.
Moneyiar market picture
Moneyiar data at the stated times showed mixed performance among the tracked digital assets:
- Chainlink (LINK): $13.7368398226, up 3.56% over 24 hours and 10.94% over seven days, as of Sept. 25, 2026, at 22:04 +03:30.
- Lighter (LIT): $4.7679181146, down 6.53% over 24 hours and 2.12% over seven days, as of Sept. 25, 2026, at 22:03 +03:30.
- Plasma (XPL): $0.1107463353, down 2.88% over 24 hours and up 17.93% over seven days, as of Sept. 25, 2026, at 22:03 +03:30.
- Horizen (ZEN): $7.5934193103, up 2.47% over 24 hours and down 9.17% over seven days, as of Sept. 25, 2026, at 22:04 +03:30.
