Bitget Hit by $387M Crypto Exploit

 

Crypto exchange Bitget has suffered a security breach that has reportedly drained over $380 million from the exchange and is on track to be the largest crypto exploit this year.

 

The exploit, which is said to have happened around 6:31 p.m. UTC on Sept. 24, involved transfers from some of the exchange’s hot wallets.

 

 

According to Gracy Chen, Bitget’s CEO, the hack occurred as a result of attackers compromising a critical backend system within the exchange’s wallet infrastructure, using this compromise to spoof transaction data and trigger the authorization process to move funds.

 

Although this hack now ranks as the largest crypto hack of the year, Bitget said that the incident fell within the coverage of its User Protection Fund, which currently holds more than $464 million, confirming that customers’ funds and deposits on the exchange were intact.

 

Bitget’s Response

 

Following the detection of the unauthorized withdrawals, the security team at the exchange swiftly activated an emergency response, temporarily suspending withdrawals while the team conducted a comprehensive security review of the incident.

 

The team also said it started working with third-party security experts Mandiant and SlowMist for a full investigation, while also providing updates about the incident, with the exchange’s CEO going on a live Q&A session on X about the incident.

 

Bitget also launched a bounty program, mobilizing exchanges and other security experts who can assist with freezing and recovering the stolen assets. So far, stablecoin issuers Tether and Circle have frozen roughly $318,000 worth of stablecoins in wallets said to be involved in the exploit, leaving a large majority of the funds still under the control of the attacker.

 

Bitget’s exploit is coming at a time when Evercrest Technologies, the company behind liquid staking protocol KelpDAO, is suing LayerZero for its alleged negligence that led to attackers exploiting the protocol for $292 million in April of this year.

 

According to a lawsuit filed against the protocol and its CEO, KelpDAO alleges that LayerZero reviewed and endorsed in writing its single verifier (1-of-1 DVN) cross-chain bridge infrastructure, which was eventually used by attackers to exploit the protocol.