Bitget after the $387.5M hack: what the forensics show before October 2

Bitget says every customer balance is intact after the largest crypto theft of 2026, and it plans to switch the last withdrawal rails back on this Thursday, October 2. So the question for anyone with money on the exchange, or watching the sector, is simple: what do the first independent forensic findings actually show about the $387.5 million hack, and what is still unresolved before full withdrawals return?

The short answer

The early evidence points to a slow-burn infrastructure compromise, not a smash-and-grab. SlowMist, one of the two firms Bitget brought in, traced the earliest malicious activity to August 31, roughly three and a half weeks before funds left the hot wallets. The attacker did not need Bitget's private keys: a custom tool built around the exchange's own withdrawal logic did the work. Bitget's balance sheet has so far absorbed the loss through its Protection Fund, but the root cause (two unnamed third-party security products), the final attribution and the recovery of funds all remain open.

What happened, in sequence

According to Bitget's statements as reported by Decrypt and a BleepingComputer reconstruction, unauthorized transfers from hot and warm wallets were detected at 18:31 UTC on September 24. CEO Gracy Chen first put the loss at $351.6 million, then revised it to $387.5 million on September 25 after counting additional assets. Bitget said cold wallets were not affected and that attackers "did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet," per Decrypt.

CertiK's monthly tally, reported on September 30, lists Bitget at $387.5 million, the single largest item in a September that it calls 2026's worst month, with $766.5 million lost across incidents.

The forensic timeline

The most detailed primary document so far is SlowMist's investigation progress report, current as of September 29 (all times in the report are UTC+8; conversions below are ours):

• August 31: a service on a node of "Product A," a third-party security product, was hit by a zero-day vulnerability. The attacker ran a hidden script, read an environment variable containing a database password and connected to the database.
• September 23 and 25: similar hidden-script activity appeared on two other Product A nodes.
• Early September 25 (UTC+8): the attacker used an internal employee's identity to access the management platform of "Product B" and tried to inject commands and upload malicious files.
• 01:49 UTC+8 on September 25 (17:49 UTC on September 24): a malicious program began executing the theft.
• 02:31:00 to 05:23:11 UTC+8 (18:31 to 21:23 UTC on September 24): on-chain transfers to attacker addresses, spanning about 2 hours and 52 minutes across multiple blockchains.

Note that SlowMist's first verified on-chain transfer lines up to the minute with the 18:31 UTC detection time Bitget announced, which gives the two accounts some mutual consistency.

The key finding: a custom withdrawal tool

SlowMist says it recovered, from files the attacker had deleted, "a highly customized withdrawal tool" that was "tailored to the wallet system's withdrawal logic." It "forged risk-control parameters," constructed withdrawal requests and invoked the withdrawal process. After the transfers began, the attacker also tried to edit withdrawal records directly in the wallet database; two fabricated BTC withdrawal orders entered processing and returned errors.

This matters because it reframes the incident. Key management held, according to both Bitget and the investigators, yet the system that decides whether a withdrawal is legitimate was subverted. Chen's description to Bloomberg, via Claims Journal, matches that: attackers used a third-party product flaw to obtain internal credentials and send fraudulent withdrawal commands that bypassed risk controls.

The second firm, Google Cloud's Mandiant, published a status update hosted by Bitget. As quoted by The Hacker News, Mandiant found that "the threat actor deployed a web shell onto the security appliance B and established a Command-and-Control (C2) connection." Neither report names the two vendors.

The money: losses, outflows and reserves

Bitget said its User Protection Fund, which stood above $464 million before the incident, would cover the full loss (Decrypt, September 25). Bloomberg reported on September 29 that the fund had fallen below $200 million and that Bitget saw $463 million in net outflows in the 24 hours after withdrawals reopened, the largest one-day outflow since DefiLlama began tracking it about four years ago. The same report put Bitget's reserves at roughly $5.7 billion.

Chen had promised to restore the fund to more than $300 million within a week. On September 30 she posted that the fund was "back to >$300M as we promised," as reported by crypto.news and Incrypted. Bitget says the fund's wallet addresses are public, so the balance can be checked on-chain.

Crypto.news also cited Bitget's proof-of-reserves snapshot from September 29, 09:00 UTC: a 131% overall ratio across 19 assets, including BTC at 142%, ETH at 110% and USDT at 107%. A reserve ratio is a self-reported snapshot. It shows assets held against customer balances at one moment; it is not a full audit of liabilities.

The phased reopening

Per The Block, withdrawals have returned in steps, each at 08:00 UTC: BTC on September 28, ETH on September 29 (Ethereum, BSC, Arbitrum, Base, Optimism) and USDT on September 30 (Ethereum, BSC, Solana, Tron). All remaining assets, fiat withdrawals and P2P are scheduled for October 2. Bitget told Bloomberg the staggering was "unrelated to the sufficiency or availability of user assets."

Attribution: suspicion, not a verdict

Chen said some IP addresses matched VPN choices used by "a certain DPRK group" and that the pattern resembled earlier North Korean operations, while stressing the identity "hasn't been confirmed" (Decrypt). Blockchain analytics firm Elliptic called a North Korea link "highly likely," per Gizmodo. Neither SlowMist's progress report nor the Mandiant line quoted above names an actor. Treat the attribution as a credible working hypothesis, not a finding.

What we know vs. what we're inferring

• Known (primary or multiply reported): a $387.5 million loss; detection at 18:31 UTC on September 24; earliest malicious activity on August 31 per SlowMist; a custom tool that forged risk-control parameters; private keys and cold wallets reported unaffected; the Protection Fund reported back above $300 million on September 30; October 2 set for the final reopening phase.
• Reported but not independently verified by us: the $463 million outflow figure (Bloomberg, DefiLlama data), the 131% reserve ratio (Bitget's own snapshot) and the Mandiant wording, which we read only as quoted.
• Inferred: the roughly 25-day gap between first intrusion and theft suggests detection gaps in the security tooling itself. That is our reading of the timeline, not a conclusion either firm has stated.
• Unknown: the identity of Products A and B, whether other companies run the same vulnerable software, how much of the stolen crypto can be frozen or recovered, and the final attribution.

What to watch next

• October 2, 08:00 UTC (04:00 ET / 05:00 UTC-3): the scheduled reopening of all remaining assets, fiat and P2P. Watch for any delay or new limits.
• Net flows in the days after October 2: whether the September 29 outflow spike repeats once every rail is open.
• The final forensic reports: whether SlowMist or Mandiant name the third-party vendors, and whether those vendors issue advisories other firms need to act on.
• Bitget's next proof-of-reserves snapshot: compare its ratios with the September 29 figures.
• Recovery efforts: any freezes by stablecoin issuers or results from Bitget's 5% recovery bounty.

Educational information only — not financial advice.