Twelve Bitget Wallets, Eleven Chains, $388M, and Valid Credentials
Twelve wallets, eleven chains, one set of credentials the wallet system read as authorized.
Bitget’s hot and warm wallets sent about $388 million on September 24.[1] The funds moved on 11 chains, Ethereum and Base among them.[2] Bitget labelled the wallets itself: twelve addresses tied to hot or warm wallets.[1]
The attacker may have used a flaw in a third-party security product, Bitget says.[3] That gave the attacker high-level credentials. It then sent withdrawal commands that got past the risk controls.[3]
Twelve wallets on eleven chains obeyed one set of credentials.[3] Bitget does not say where the funds sit now. It says user balances were untouched, and its Protection Fund covers the impact.[4]
What to do: no action needed — the exchange says user balances were untouched.[4]
Who gains, who loses
Receipts
Bitget said approximately $388 million was affected in its September 24 security incident, involving 12 wallet addresses associated with hot or warm wallets.
“The amount affected is currently estimated at approximately $388 million.”
Bitget said the incident affected 11 blockchains, including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand and Celestia.
“The incident involved activity across 11 blockchains:”
Bitget said its attacker may have exploited a third-party security-product vulnerability to obtain high-level internal credentials and use them to send fraudulent withdrawal commands that bypassed existing risk controls.
“The attacker then appears to have used those credentials to impersonate authorized activity and send fraudulent withdrawal commands to the wallet system, resulting in abnormal transfers that bypassed existing risk controls.”
Bitget said user account balances remained unaffected and that its Protection Fund covered the financial impact of the platform-wide incident.
“Bitget's Protection Fund covers the financial impact of this platform-wide incident.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.