Seven months before attackers moved nearly $388 million out of Bitget, the crypto exchange published a security framework saying third party systems should be treated as a security boundary and subjected to "continuous monitoring and strict integration controls," The Coinformer found.
Bitget now says a vulnerability in exactly that part of its infrastructure gave attackers the credentials they needed to bypass its withdrawal safeguards.
- In a Monday post on X, Bitget CEO Gracy Chen said that the attackers "exploited vulnerabilities from third-party products to steal internal credentials, then used those credentials to send fraudulent withdrawal commands that bypassed our risk controls."
- Private keys "were not compromised," she added.
- Bitget hasn't identified the third party vendor or product.
Quick recap from today's livestream:
— Gracy Chen @Bitget (@GracyBitget) September 28, 2026
1. Withdrawals
BTC live on Bitcoin Mainnet & BSC — 9,585 orders, 4,098.036 BTC processed as of 17:00 UTC+8. ETH, USDT, others follow in phases starting tomorrow.
2. What happened
Full trace-back complete. The attacker exploited… pic.twitter.com/BmyTNFJgFC
Bitget had warned about the risk
In February, Bitget and blockchain security company BlockSec jointly published what they called the "UEX Security Standard," a framework for securing the increasingly complex infrastructure behind crypto exchanges.
- The report warned that off-chain dependencies, including cloud infrastructure, had to be "hardened against adversaries," adding further that gaps between interconnected systems could become attack paths.
"Third-party and supply-chain governance is treated as a security boundary," it said, adding that such systems were subject to "continuous monitoring and strict integration controls."
The document also said Bitget used automated dependency controls and security gates intended to keep high-risk components from reaching production.
- The report was a security framework jointly authored by Bitget and BlockSec, however, not an independent audit certifying that every described control was effective across Bitget's live infrastructure.
"Protection at every layer"
And the messaging continued just days before the attack.
On Sept. 18, just six days before the hack, Bitget chief legal officer Hon Ng published an anniversary letter under a section titled "Protection at Every Layer."
"Security has to follow users across the platform, from account access and transaction monitoring to the underlying infrastructure. No single tool or control can address every risk, which is why we think about security in layers," Ng wrote.
He pointed to withdrawal safeguards, transaction monitoring, anomaly detection and fraud-prevention systems operating behind the platform.
And yet, on Sept. 24, Bitget detected unauthorized transfers from portions of its hot and warm wallet infrastructure.
- Bitget says the vulnerability has since been fixed and the incident contained.
- Blockchain security firms Mandiant and SlowMist are assisting with the investigation, while withdrawals are being restored in phases.
- But the unanswered question is how credentials obtained through one third party product were able to authorize withdrawals large enough to bypass controls that Bitget had spent months publicly describing as layered, isolated and continuously monitored.
The Coinformer asked Bitget to identify the vendor, explain which controls were bypassed and clarify why the compromised credentials were sufficient to authorize the transfers, but didn't hear back by press time.