Bitget stopped withdrawals at 19:05. The theft ran to 21:23
Bitget, Mandiant and SlowMist have published how $387.5M left Bitget's hot and warm wallets on 24 September. The attacker came in through two third-party security products, and its withdrawal tool kept sending for 138 minutes after Bitget blocked withdrawals.
On 24 September, Bitget's risk system blocked withdrawals across the platform at 19:05 UTC. The last stolen transfer left its wallets at 21:23.
When we first covered the incident, Bitget had published one notice: approximately $351.6M in unauthorized transfers, method not disclosed. Since then it has published a timeline, and the two firms it hired, Mandiant and SlowMist, have each released a report. Together they show how the attacker got in and why the block did not end the theft.
This piece uses only what those three have published, plus Chainalysis's tracing. We have not traced the transfers ourselves.
What left, and where it went
The loss is now $387.5M. Bitget raised its estimate from $351.6M after it found further transfers on Zcash and Tron. Mandiant lists the assets: XRP, ETH, USDT, USDC, BNB, AVAX, TRX, ZEC and Tether Gold. Cold wallets were not touched, and Bitget saw no evidence that a private key was compromised.
Chainalysis counted 23 transfers in the first three hours, worth about $387M: 49.7% on Ethereum, 40.8% on XRP, 7.6% on Zcash and 1.8% on Tron. Within days the attacker was swapping ETH for BTC through THORChain. Bitget CEO Gracy Chen asked THORChain to refuse service to the attacker's addresses. THORChain answered that its halt is an emergency mechanism for the whole network and cannot freeze specific funds or swaps.
How the attacker got in
Through Bitget's security tooling. SlowMist calls the two compromised third-party products "Product A" and "Product B"; Mandiant calls them security appliances A and B. Neither report names the vendor.
SlowMist's earliest evidence is from 31 August, more than three weeks before the theft. A zero-day in a service on one node of Product A let the attacker run a hidden script that read the database password from an environment variable. The same activity turned up on two more nodes on 23 and 25 September (UTC+8). Mandiant found a web shell on appliance B with a command-and-control connection, and traced the attacker from there to Bitget's production wallet job server.
On that server SlowMist recovered a deleted tool written for Bitget's wallet system. It "forged risk-control parameters in its code, constructed withdrawal requests, and invoked the withdrawal process." Bitget's own account adds that the forged commands were processed as normal withdrawals and that the attacker later deleted traces of them.
Why the block did not stop it
The 19:05 block was applied to withdrawal requests. Customer withdrawals stopped at that point. The attacker was not sending requests through that path: its tool sat on the server that builds withdrawals and hands them to signing.
Mandiant's report puts it directly: the unauthorized transfers "were executed alongside legitimate internal wallet operations on Ethereum until about 05:23 UTC+8 of the same day, almost three hours after detection." That is 21:23 UTC, 138 minutes after the block. SlowMist also logged the attacker trying to edit withdrawal records directly in the wallet database after 21:22, and two forged BTC orders that entered processing and failed.
Bitget's timeline does not say which step ended the transfers. Its wallet team began moving funds to cold wallets at 20:40, because a key compromise had not been ruled out. Signing services were shut down at 21:44.
The cleanup
- Withdrawals came back in phases: BTC on 28 September, ETH on 29 September, USDT on 30 September, everything else including fiat and P2P on 2 October at 08:00 UTC. Chen said the order applied to every user, with no priority for institutions, VIP clients or staff.
- The Protection Fund covered the loss. Bitget refilled it to more than $300M on 30 September.
- Recovery is not expected to be large. Chen told CNBC on 2 October that Bitget is "not expecting to recover a lot."
- Attribution. Chainalysis attributes the theft to North Korean actors. Chen has been more cautious, pointing to IP behaviour and VPN infrastructure consistent with known North Korean operations without confirming it.
What is still missing
- The names of the two products. Mandiant and SlowMist both describe them and neither names them. Other exchanges and custodians may run the same software.
- What ended the transfers. The cold-wallet sweep at 20:40, an empty hot wallet, or something else before signing went off at 21:44.
- How the attacker moved from the security products to the wallet server. SlowMist says that part of its investigation is still open.
Bitget is the second nine-figure custody loss of September, after Liquid's $319M on 6 September through a bug in shared node software. At Bitget the keys held; the money left through a server that was allowed to ask for signatures.
Sources: Bitget's security notice of 24 September, its incident timeline and its notice of the investigation reports; SlowMist's investigation progress report (as of 29 September, times in UTC+8); Mandiant's status report of 28 September. Chainalysis's transfer count, chain split and attribution via crypto.news. Withdrawal schedule, THORChain exchange and Chen's statements on priority from Cointelegraph; recovery expectations from CNBC.