Bitget Hack Details: How Fraudulent Approvals Enabled $387M Theft

The Bitget hack has turned into a much bigger security incident than the exchange’s first estimate suggested. Bitget now says attackers stole $387.5 million from its exchange wallets on September 24, while withdrawals remain suspended and the company says its protection fund covers the loss.

Mandiant and SlowMist are investigating. CEO Gracy Chen suspects North Korean involvement, but the initial entry point remains undisclosed.

Bitget Hack Timeline Starts With Unauthorized Transfers

Bitget says its security systems detected unauthorized transfers at 18:31 UTC and activated emergency procedures within minutes. The incident affected parts of its hot and warm wallets, while offline cold wallets remained secure, according to the company.

That detection time doesn’t establish when attackers first gained access.

At 19:57 UTC, analyst DCF GOD flagged a fresh wallet spending $19.67 million in USDT0 to purchase 7,111 ETH within six minutes, reportedly paying as much as 5% above market prices.

Then, at 21:06 UTC, Bubblemaps reported roughly $180 million moving from Bitget wallets to a common receiving address before being split across several wallets.

Bitget Hack Appears To Exploit Authorization

At 21:30 UTC, Chen’s security notice put the initial loss at $351.6 million and confirmed withdrawals had been paused. The notice arrived almost three hours after Bitget’s stated detection time, although that gap doesn’t prove funds continued leaving during the entire period.