Bitget CEO：3.88亿美元黑客攻击事件与第三方安全漏洞有关

Bitget CEO: Detailed explanation of the $388 million hack incident

Bitget CEO Gracy Chen said that the $388 million exploit incidents reported by the exchange were triggered by weaknesses in third-party security products. The attacker allegedly used this vulnerability to obtain "advanced internal credentials." In an interview with Cointelegraph, Chen pointed out that the theft involved fraudulent withdrawal instructions, not the disclosure of Bitget's own private key.

Bitget said that the incident began on September 24, when the exchange detected unauthorized transfers of funds in multiple hot wallets and temporarily suspended the withdrawal service. Although the exchange initially estimated the amount affected at approximately US$352 million, Chen emphasized that key security layers-namely Bitget's private key and cold wallet-had not been compromised.

Core Points

• Root cause of the vulnerability: Chen blamed the attack on Bitget on the vulnerability of third-party security products, not the exposure of Bitget's private key.
• Attack method: According to Chen, the attacker used the obtained internal credentials to generate fraudulent withdrawal instructions;Bitget's cold wallet was not affected.
• Countermeasures: Bitget said it has fixed security vulnerabilities and tightened withdrawal controls, including restricting internal access and adding verification links.
• Recovery status: After the attack, Bitget suspended the withdrawal service and later restored some functions, but did not disclose the specific amount of funds recovered or frozen.
• Collaboration Freeze: Chen表示Bitget正在协调冻结被盗资金，但由于技术限制，无法依赖像THORChain这样的去中心化协议来单独屏蔽地址。

9月24日事件的经过机制

Bitget的事件核心在于漏洞利用的机制。Chen向Cointelegraph透露，攻击者通过交易所环境中使用的第三方安全产品存在的漏洞，获得了“高级内部凭证”。拥有这些凭证后，攻击者发出了欺诈性的提现指令。关键在于，她坚持认为Bitget的私钥未受侵害，冷钱包也未受影响。这一区别至关重要，因为它表明此次事件更多是关于滥用授权的执行路径，而非提取或篡改最敏感的钱包材料。

Cointelegraph报道称，攻击发生在9月24日，当时Bitget检测到源自几个热钱包的未经授权的资金转移。Bitget最初估计约有3.52亿美元资产受到影响，后来在报告中将更广泛的数字表述为3.88亿美元。

恢复状况仍不明确

尽管Chen评论了进展，但Bitget尚未公布已追回或冻结的加密资产数量。Chen表示，在其他行业参与者的帮助下，部分资产已被冻结，但Bitget计划在核实金额后才提供完整总数。

This incomplete information is a key uncertainty for investors and counterparties. Exchange hacking incidents typically go through multiple stages-preliminary loss estimates, subsequent wallet tracking, cooperation with intermediaries, and final recovery or revocation. Bitget's decision not to release the consolidated figures until verification suggests it is still reconciling the flow of funds between affected wallets and counterparties.

Readers following the case should pay attention to subsequent updates to clarify the gap between the "initially affected" funds and the total amount of funds actually recovered or frozen.

Tighten withdrawal controls after exploit

Bitget said it has addressed the underlying security vulnerability and changed the way it handles withdrawals. Chen described measures taken, including restricting internal access, adding independent verification for withdrawals, and strengthening monitoring of unusual activity.

The emphasis on process controls, rather than just patching software issues, highlights the practical lesson faced after a credential-type incident where the exchange is located: Even if core wallet security remains intact, attackers can still exploit trust boundaries in operational workflows. By tightening internal access and introducing additional independent inspections, Bitget seeks to reduce the likelihood that fraudulent instructions will be executed without detection.

Investors should also consider what "independent verification" means operationally. Although the company's description does not elaborate on specific mechanisms, the intention is clear: to create redundant mechanisms so that a single contaminated credential path is insufficient to authorize withdrawals without further confirmation.

Controversy over THORChain: There is no selective blacklist in the decentralized protocol

Bitget has previously urged THORChain, a protocol designed to exchange assets between different blockchains, to refuse to service addresses linked to the attack. Chen said Bitget did not ask THORChain to stop its network operations while it worked to prevent the flow of stolen assets.

At the same time, Chen admitted that THORChain stated that it could not selectively block individual addresses. She told Cointelegraph that Bitget respects the technical constraints of decentralized protocols and does not seek actions that are not feasible at the protocol level.

This exchange highlights broader tensions in cross-chain security incidents. Centralized exchanges can often use internal data and counterparties to coordinate blacklist or withdrawal controls, but decentralized networks may be limited by the way they authenticate and route transactions. When stolen funds move across chains, the actual friction is often determined not by the intention, but by what the underlying protocol can enforce.

Chen's comments suggest that Bitget's strategy is to focus on the actions it can promote-freezing assets, tightening operational controls, and coordinating through parties that can impose restrictions-rather than expecting the broader infrastructure stack to behave like a centralized gatekeeper.

Suspected North Korea: Still under forensic assessment

Chen also talked about Bitget's earlier suspicion that North Korea may be behind the scenes, citing preliminary IP-related indicators. She told Cointelegraph that early information was based on preliminary survey results and that these indicators are still being evaluated.

Chen表示，Mandiant和SlowMist正在支持独立的法医调查，且工作正在进行中。她补充说，Bitget只会在证据得到验证后分享进一步的调查结果。

这对读者来说很重要，因为重大黑客事件中的归属声明很容易变得具有推测性。通过将早期指标定性为初步性质，并强调独立的法医工作，Bitget发出的信号是，在证据得到确证之前，它希望避免得出硬结论。

接下来值得关注的是，Bitget最终是否会提供经核实的追回和冻结总额，以及其事后控制措施的改变在证明有效性方面有多快——特别是在应对基于凭证的提现滥用方面——同时归属调查结果从初步指标演变为确定的结论。