Bitget detected unauthorized transfers involving a limited number of hot wallets at 18:31 UTC on September 24. Subsequent tracing identified approximately $387.5M transferred to attacker-controlled addresses across Ethereum and other EVM networks, XRP Ledger, Zcash and Tron. Bitget states that the incident has been contained and no further unauthorized transfers are possible

Unauthorized transfers drained about $387.5 million from some of Bitget’s hot and warm wallets. The attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then issued fraudulent withdrawal commands that the wallet authorization process treated as legitimate. Private keys and cold wallets were not compromised. Customer balances remain covered by Bitget’s User Protection Fund.