Skip to content

Back to the catalog

theblock.coarticle

Bitget attacker tested risk controls with small transfers before $388 million theft, CEO says

The Block interviews Bitget CEO Gracy Chen about the 24 September 2026 theft of about $388 million. The attacker used a zero-day in a third-party security product to gain admin access, injected fraudulent withdrawal commands into wallet backends and deleted traces. Small test transfers (0.184 ETH, 193 TRX) fell below risk-control thresholds before 17 larger transfers across eight chains. Bitget says private keys and cold wallets were safe; Mandiant and SlowMist are investigating.

TL;DR Bitget's CEO says a third-party security product zero-day gave admin access for forged withdrawals, after sub-threshold test transfers, in a $388M theft.
Open original ↗

Organisations named here

  • Bitget
  • Mandiant
  • SlowMist
  • The Block

Technologies named here

  • Bitget
  • Mandiant
  • SlowMist
  • Unnamed third-party security product (zero-day exploited for admin access)

Techniques named here

  • Zero-day exploitation
  • Indicator Removal
  • Command injection into wallet backends
  • Sub-threshold test transfers

Concepts named here

  • Cold wallet and private key isolation
  • Exchange counterparty risk
  • Risk-control thresholds
  • User protection fund

Also named here

  • Gracy Chen

Related in Threat Intel