Bitget CEO says $388M attacker tested its risk controls with two tiny transfers first

The person or group that drained roughly $388 million from Bitget on Sept. 24 first ran a dry run, according to CEO Gracy Chen, who laid out a timeline in an interview with The Block's Gareth Jenkinson.

Chen said the first two unauthorized transfers hit at 6:31 p.m. UTC: 0.184 ETH from an Ethereum hot wallet and 193 TRX from a Tron hot wallet. Both sat under Bitget's risk-control threshold and set off no alerts — in effect, a test of where the tripwires were. About 30 minutes later the draining began in earnest: 17 transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche, between 6:58 p.m. and 8:09 p.m., totaling roughly $361 million by Chen's count.

According to Chen, Bitget's reconciliation system flagged a discrepancy within seven minutes of the first large transfer, at 7:05 p.m., and its risk system froze all user-initiated withdrawals platform-wide. By then the attacker was already inside: Chen said they exploited a zero-day in a third-party security product to obtain valid admin credentials, injected fraudulent withdrawal commands directly into wallet backend systems so they'd be processed as legitimate, then deleted the traces — the part Chen called "the trickiest." Private keys and cold wallets were not compromised, the exchange says.

Bitget is working with incident responders Mandiant and SlowMist and expects to publish a formal report this week. On who did it, Chen would only say it's "still the same group of people that we suspect," declining to name them before the report. The exchange's user protection fund, valued at $465 million on Sept. 25, will absorb the loss and be topped back up to at least $300 million within a week from corporate reserves that stood above $1.4 billion at an Aug. 31 audit. BTC withdrawals reopened Monday — more than 3,000 BTC in the first hour, per Chen — with ETH withdrawals due Sept. 29.

Key facts

• ~$388M total loss; the 17 large transfers totaled ~$361M (Chen, via The Block).
• Test transfers at 6:31 p.m. UTC Sept. 24: 0.184 ETH, 193 TRX — under alert thresholds (Chen).
• Large draining 6:58–8:09 p.m. across eight chains; withdrawals frozen 7:05 p.m. (Chen).
• Entry via a zero-day in a third-party security product; traces deleted afterward (Chen).
• Protection fund $465M (Sept. 25); corporate reserves >$1.4B (Aug. 31 audit) (Chen).
• Investigators: Mandiant, SlowMist; incident report expected this week (Chen).

The real-world read

Every figure and claim here traces to one interested party — Bitget's own CEO — and the promised third-party incident report isn't out yet. Nothing has been independently verified. The numbers also don't fully close: Chen's own $361 million in large transfers is about $27 million short of the ~$388 million loss, a gap the timeline doesn't explain. "Same group we suspect," with no name, is not attribution. And the reassurance points cut both ways — the reconciliation system caught the discrepancy in seven minutes, but only after an attacker with valid admin credentials had already moved most of the money and then scrubbed the logs. Treat the "serious doesn't mean existential" framing and the $1.4 billion reserves figure as what they are: an exchange managing a solvency narrative mid-incident. The report, if it's specific and corroborated by Mandiant and SlowMist, is what matters.

Opinion, and whose

• Gracy Chen (Bitget CEO): the breach is "very serious" but "serious doesn't mean existential," and the deletion of traces was the hardest part of the investigation.

Sources

• The Block (Gareth Jenkinson interview), Sept. 28 — timeline, transfer amounts, entry method, fund and reserve figures, withdrawal-resumption details. Secondary reporting; all substantive claims are attributed to Bitget's CEO, an interested party. The forthcoming Bitget/Mandiant/SlowMist incident report is the primary source and was not yet available.

Not financial advice.