Writing
Bitget, September 2026: what the public record says about the withdrawal path
Bitget and the two forensic firms it engaged describe the same incident in different terms, and the two firms label their accounts preliminary or in progress. This note sets out what each says, with dates, and what none of them says.
On 24 September 2026 Bitget reported unauthorised transfers from its hot wallets. Its first estimate was about $351.6 million; its latest figure, published on 13 October and 20 October 2026, is a “final verified” $388 million. Bitget says forged withdrawal commands were written into its wallet system after attackers exploited a zero-day vulnerability in a third-party security product and used stolen credentials. Mandiant and SlowMist, engaged by Bitget, each published an interim account that does not name the security products involved.
The review is recent. Several accounts are described by their own authors as preliminary or in progress, and this note will be out of date if they are revised. Every statement is tagged by source. Nothing here is a finding about the internal controls of any named company beyond what a source says, and no source read names the vendors of the security products.
What the sources state
Times are as printed by each source. Bitget’s pages use UTC; the Mandiant and SlowMist reports use UTC+8, so 02:31 on 25 September (UTC+8) is 18:31 on 24 September (UTC). The status column is the source’s own label or our reading of its wording.
| Date | What | Source and status |
|---|---|---|
| 31 Aug 2026 | The earliest malicious activity in the logs available to SlowMist. A service on one of “Product A”’s nodes was affected by a zero-day vulnerability; the attacker ran a hidden script, read an environment variable holding a database password and connected to the database. Similar activity was seen on two other nodes on 23 and 25 September. | SlowMist progress report, as of 29 Sep (in progress) |
| 24 Sep 2026 | A threat actor gained “unauthorised privileged access” to Bitget’s third-party security appliances A and B, deployed a web shell on B with command-and-control, moved to Bitget’s production wallet job server and deployed malicious packages. | Mandiant status report, 28 Sep (“Preliminary Findings”, investigation ongoing) |
| 25 Sep 2026, from 00:07 (UTC+8) | The attacker accessed Product B’s management platform using an internal employee’s identity and made three attempts to inject system commands, then submitted code through the platform’s web execution endpoint. | SlowMist (in progress) |
| 25 Sep 2026, 01:49 (UTC+8) | A host log shows a malicious program, recovered by SlowMist as a customised withdrawal tool, began running and executing theft. | SlowMist (in progress) |
| 24 Sep 2026, 18:31 UTC | First unauthorised transfers from hot and warm wallets. SlowMist’s earliest verified transfer is at 02:31:00 on 25 Sep (UTC+8), 93 TRX, followed 11 seconds later by 0.84 ETH on Ethereum. | Bitget incident page (last updated 13 Oct); Bitget academy article; SlowMist |
| 24 Sep 2026, 19:05 UTC | Bitget’s reconciliation system detected a discrepancy in fund verification; risk controls then blocked withdrawals across the platform. | Bitget incident page (last updated 13 Oct) |
| 24 Sep 2026, posted 21:39 | First notice: unauthorised transfers from “some of our hot wallets”, estimate “approximately $351.6 million”, “Cold wallets remain fully secure”, no speculation on the attack vector until the investigation is complete. | Bitget notice, 24 Sep (preliminary) |
| 25 Sep 2026, to 05:23 (UTC+8) | Transfers continued across multiple blockchains for about 2 hours 52 minutes, on Ethereum alongside legitimate internal wallet operations (Mandiant). After the transfers began the attacker also tried to alter withdrawal records in the wallet database; two fabricated BTC withdrawal orders entered processing and returned errors (SlowMist). | Mandiant; SlowMist |
| 25 Sep 2026, 08:43 and 13:42 UTC | Bitget’s academy timeline lists, at 08:43, “Bitget’s security team identifies the root cause of the incident” and, at 13:42, “The incident is reported to law enforcement in the jurisdiction where the relevant Bitget entity is based.” No agency is named. | Bitget academy article (updated 20 Oct) |
| 25 Sep 2026, posted 14:05 | Estimate revised to about $387.5 million, adding assets on Zcash and TRON. Bitget says it has identified the attack path and how the attacker bypassed existing controls, without describing either, and lists attacker receiving addresses. | Bitget notice, 25 Sep (updated estimate) |
| 26 Sep 2026, posted 03:55 | Phased resumption of withdrawals announced: BTC 28 Sep, ETH 29 Sep, USDT 30 Sep, other services 2 Oct. Bitget says the vulnerability involved has been identified and remediated and that the incident is contained. | Bitget notice, 26 Sep |
| 30 Sep 2026 | Bitget publishes the Mandiant and SlowMist reports and says both investigations “identified the compromise of third-party security products” that enabled unauthorised access to its wallet environment. It names no vendor. | Bitget notice, 30 Sep |
| 13 and 20 Oct 2026 | Bitget’s incident page and academy article give approximately $388 million as the “final verified” amount, 12 wallet addresses (11 blockchains per the article). They say attackers wrote forged withdrawal commands directly into the wallet system, which were processed as normal withdrawals and bypassed risk checks, then deleted traces; private keys were not compromised and cold wallets were unaffected. | Bitget incident page (13 Oct); Bitget academy article (20 Oct) |
Where the sources differ
The amount. Bitget’s first notice (24 Sep) says about $351.6 million; its 25 Sep notice says about $387.5 million; its incident page (13 Oct) and academy article (20 Oct) say approximately $388 million and call it final. Mandiant (28 Sep) gives Bitget’s estimate as a range between $351.6 million and $387.5 million. Bitget attributes the first revision to Zcash and TRON assets; the pages read do not say what changed between $387.5 million and $388 million.
Detection. Bitget’s first notice says the unauthorised transfers were detected at 19:05 UTC. Its incident page says the transfers began at 18:31 UTC and its reconciliation system detected a discrepancy at 19:05 UTC. Mandiant says Bitget’s security monitoring detected unauthorised outbound transfers at 02:31 UTC+8, which is 18:31 UTC.
How many products, and which was exploited. Bitget’s incident page and academy article refer to a zero-day in “a third-party security product”; its 30 Sep notice says “products”. Mandiant describes two security appliances, A and B, and does not use the term zero-day. SlowMist describes two products, A and B, plus a wallet application host, and places the zero-day on Product A.
Route to the wallet system. Bitget says stolen internal network credentials with high privilege were used to reach wallet-related backend servers. SlowMist says the attacker used an internal employee’s identity on Product B’s management platform. Mandiant says the actor moved from appliance B to a production wallet job server and deployed malicious packages. The sources do not say whether the credentials and the identity are the same thing, or reconcile “wallet-related backend servers”, “wallet job server” and “wallet application host”.
The withdrawal step. Bitget says attackers wrote forged withdrawal commands into the wallet system. SlowMist describes a customised withdrawal tool that forged risk-control parameters, constructed withdrawal requests and invoked the withdrawal process. These may describe the same step; neither source says so.
Private keys. Bitget’s incident page and academy article state private keys were not compromised. Mandiant words it as Bitget not having observed evidence of key compromise. Bitget’s academy timeline includes an entry of 24 Sep, 20:40 UTC, saying key compromise had not yet been ruled out. SlowMist’s progress report does not address keys.
Wallet scope and root-cause timing. Bitget’s first notice refers to hot wallets; later Bitget pages and Mandiant say hot and warm wallets. Bitget’s academy article states that its security team identified the root cause on 25 Sep at 08:43 UTC, while its 25 Sep 14:05 notice does not describe the attack path and Mandiant (28 Sep) and SlowMist (29 Sep) both describe their work as continuing.
Status of the documents. The “final verified” label on Bitget’s pages applies to the amount. Mandiant’s section is headed “Preliminary Findings” and SlowMist’s document is a progress update. We found no later report from either firm and no Bitget internal report.
What the sources do not say
- Which vendors or products are the “third-party security products”. Bitget, Mandiant and SlowMist all withhold the names.
- How the forged commands were validated, or by what component, before processing, and which risk checks were bypassed and why.
- Whether any human approval step existed on the affected path, and if so how it was passed.
- How the credentials or employee identity were obtained, and whether the activity SlowMist dates from 31 August is connected to the 24 September access Mandiant describes.
- What Bitget changed afterwards, beyond saying the vulnerability was “identified and remediated” and the affected vendor functionality disabled.
- Who is responsible. No source read attributes the incident to any actor, and we found no police or regulator statement. Bitget says it reported the incident to law enforcement and names no agency.
- Any final root-cause report. None was found from Bitget, Mandiant or SlowMist.
What the sources say about controls
Bitget says its reconciliation system detected a discrepancy and that its risk controls then blocked withdrawals platform-wide. It says the forged commands bypassed risk-control checks and were processed before normal withdrawal records were created. It says cold wallets held the majority of platform assets and were unaffected, that the vulnerability was remediated, that the affected vendor functionality was disabled, and that its Protection Fund covers the impact. SlowMist says the withdrawal tool forged risk-control parameters in its own code, and that later fabricated BTC orders “returned errors”. Mandiant says the transfers were executed alongside legitimate internal wallet operations. These are the sources’ statements, not our assessment of Bitget’s controls. SlowMist notes its work rests on materials supplied by Bitget.
Questions a withdrawal-path review asks
These are the questions we put to any exchange whose withdrawal commands pass through an approval back end and third-party security products. They are our analysis of a structure the public record describes, not a statement that Bitget or any other company lacked a control.
Sources
- Bitget, notice on unauthorised transfers, 24 Sep 2026: bitget.com
- Bitget, fund tracing and recovery bounty notice, 25 Sep 2026: bitget.com
- Bitget, phased resumption of withdrawals, 26 Sep 2026: bitget.com
- Bitget, update on the SlowMist and Mandiant reports, 30 Sep 2026: bitget.com
- Bitget, security incident page, last updated 13 Oct 2026: bitget.com
- Bitget academy, incident timeline article, last updated 20 Oct 2026: bitget.com
- Mandiant, Bitget Incident Response Status Report, 28 Sep 2026, as hosted by Bitget: PDF
- SlowMist, Bitget Security Incident Investigation Progress Update, as of 29 Sep 2026: PDF; SlowMist’s own site records the engagement: slowmist.com
Quotations and dates are as printed in the sources. Times in the Mandiant and SlowMist reports are UTC+8; conversions to UTC are ours. The Mandiant report was read as hosted by Bitget, not on a Mandiant or Google Cloud site, and is marked proprietary and confidential on its pages. This review is recent and may change as Bitget, Mandiant or SlowMist publish more; the date at the top is the date of this reading. We did not read Bitget’s social-media posts or its tracing dashboard, and we found no police or regulator statement. If you represent a company named here and see an error, write to research@deebug.io and we will correct it.