The Bitget Security Breach and Ongoing Recovery: A Comprehensive Overview

Who

The Target: Bitget, a major global cryptocurrency exchange.
The Victims/Users: Bitget platform users whose funds were held on the exchange. Bitget leadership (including CEO Gracy Chen) confirmed that user balances would not suffer direct losses.
The Threat Actors: Unidentified hackers (security investigators like ZachXBT have pointed to potential laundering networks tied to malicious actors).
Key Industry Partners: Cross-chain protocols and services like NEAR Intents (which blocked laundering attempts), SlowMist, and Chainflip, which aided tracking and intervention efforts.

The Incident: A massive security breach resulting in approximately $387.5 million in unauthorized cryptocurrency transfers out of the exchange's hot and warm wallet facilities.
Affected Assets: Stolen tokens spanned multiple blockchains and included ETH, XRP, USDT, USDC, ZEC, BNB, AVAX, and TRX.
The Recovery & Interception: Cross-chain liquidity protocols like NEAR Intents successfully blocked over $50 million in attempted laundering transfers, actively freezing $503,000 during transaction execution.
Financial Backstop: Bitget announced that its User Protection Fund (containing over $460 million) will fully cover the financial impact, preventing user losses.

The Exploit Mechanism: Attackers bypassed standard risk protocols by compromising a critical backend system in Bitget's wallet infrastructure, effectively spoofing internal transaction data so that the exchange's authorization system approved the withdrawals. Private keys and cold storage wallets remained uncompromised.
The Defense & Mitigation: Automated screening tools on decentralized protocols detected anomalous patterns, allowing platforms like NEAR Intents to intercept and block millions in illicit routing flows.
Phased Restoration: Bitget implemented a strict, multi-day scheduled reopening of network withdrawals to ensure rigorous security checks.

The Attack: Began on September 24, 2026 (around 18:31 UTC).
The Recovery Phase & Rollout:
September 28: Bitcoin (BTC) withdrawals reopened.
September 29: Ethereum (ETH) and EVM networks reopened.
September 30: USDT withdrawals restored across Ethereum, BSC, Solana, and Tron.
October 2: Scheduled return for remaining tokens, fiat, and peer-to-peer (P2P) services.

Primary Platform: The Bitget centralized exchange infrastructure.
Cross-Chain Impact: Stolen funds and tracking efforts spanned at least seven major blockchain networks, including Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base.

Why It Happened: Vulnerabilities within internal backend wallet management systems allowed fraudulent instructions to mimic legitimate internal commands, circumventing normal risk parameters.
Why Interception Matters: Because public blockchain transactions are immutable and non-traditional (lacking automatic bank chargebacks), rapid cross-industry cooperation and protocol-level freezing mechanisms are the only practical ways to stymie hackers attempting to wash millions through decentralized swappers.
Why Bitget Covered the Loss: To maintain consumer trust, prevent mass platform abandonment, and validate the purpose of dedicated safety reserves like the User Protection Fund.

For technical breakdowns of the exploit mechanics, read the SafeState Bitget Hack Analysis.
For insights into how NEAR Intents intercepted the laundering flows, check out the report on FinanceFeeds and Bitcoin.com News.
For ongoing updates regarding reserve metrics and token flow tracking, review coverage on CryptoSlate and Investing.com.

Image from thread

Posted Using INLEO