Bitget revealed 388 million stolen reasons: hackers used a zero-day loophole in third party security products to access internal critical management systems

This post is part of a public broadcast by Bitget CEO Grace Chen and the head of the China-China region, Shen Jia In, on recent security incidents. Bitget disclosed that the attackers had used loopholes in third-party security products to obtain internal high-authority vouchers, then forged cash orders and bypassed wind controls to transfer approximately $388 million of assets from multiple hot and warm wallets. Bitget ' s private key and cold wallet were not affected, the user balance was not lost and the related losses would be borne by the User Protection Fund.

The attack and the emergency response process were re-recorded in detail. Bitget states that the attackers passed a small transfer test and then initiated large transfers in multiple chains such as Etheleum, XRP, BSC, Arbitrum, Avalanche, etc., and removed traces after operation. The platform suspends cash withdrawal, transfers surplus funds and processes after detection of anomalies, ultimately pointing the attack path to a zero-day loophole in third party safety products. Currently Bitget has isolated affected systems, replaced internal vouchers and enhanced high-sensitivity clearances and cash validation.

In the case of stolen funds, Bitget indicated that asset recovery would not be the main way to secure user funds, but rather would rely on protection funds to cover losses and plan to replenish the fund within a week to at least $300 million. Meanwhile, the Platform has initiated asset recovery rewards and conducted investigations and chain-to-link tracking with agencies such as Mandiant, Slow Mist, etc.

Bitget CEO responding to $388 million in security incidents

Gracy ChenThis is a live video of the security incident that took place on September 24 and, if it's Asian time zone, September 25. We will present the results of our current investigation, disposition and recovery, follow-up arrangements, and answer your concerns.

The UTC+8 time zone is 2:31 a.m. on September 25th, there are unauthorized transfers of parts of Bitget's hot wallet and warm purse infrastructure in multiple chains. After investigation, the attackers took advantage of loopholes in third-party security products to obtain high-authority internal vouchers and forged cash instructions to the wallet system to bypass risk verification.

The route of the attack is now clear, loopholes have been repaired and incidents controlled, and no unauthorized transfers have since been detected. The total value of assets transferred is confirmed to be approximately $388 million. Mandiant and slow fog are assisting us in our investigations and chain tracking, and the addresses of the attackers and related tracing data are made public, with a view to promoting industry-wide collaboration.

This loss will be entirely covered by Bitget User Protection Fund. After using the protection fund, companies will use their own funds to replenish the protection fund to at least $300 million worth of assets within a week.

We have also launched asset recovery reward schemes to track and recover assets in partnership with security companies, law enforcement agencies, trading platforms, public-chain projects and other industry partners. The identified loopholes and offensive information will also be shared with a wider range of industry participants and the progress of asset tracing and recovery will be published on an ongoing basis.

This event is a very serious test for Bitget. We will not shy away from it, and we hope to learn from it, nor will we allow it to define Bitget.

From microtesting to multi-chain large asset transfer

Gracy Chen: Then go to the time line of the attack.

According to the UTC+8 time zone, on September 25, at 2:31 a.m., hackers first made two very small transfers: 0.84 ETH from the Etherwood hot wallet and 93 TRX from the Tron hot purse. Because the amount was very small, it fell below the then wind control threshold, no system warning was triggered.

2 P.A. 58 to 4 P.09 is a critical stage. Hackers initiate 17 large fund transfers with a total value of about $360 million on multiple chains such as Estherum, XRP, ZEC, BSC, Base, Arbitrum, Optimism and Avalanche.

Seven minutes after the first large transfer, i.e. at 3:05, the Platform ' s reconciliation system monitored significant discrepancies and the risk system automatically blocked a user-initiated cash withdrawal request for the entire platform. 3:14, the Platform launched an emergency response at the highest level of P0; 3:40, the technical team began to take measures to stop damage.

At 4:40, as the risk of private keys being stolen could not be completely ruled out at that time, the wallet team began to reassemble funds into cold purses. Between 4:55 and 5:23, hackers launched a second round of seven transfers worth approximately $28 million involving Avalanche, XRP, Etheum, ZEC, ALGO, TIA and ATOM.

At 5:44 p.m., the technical team stopped cashing services such as a signing machine and placed security barriers to access, making an initial determination that the private key was not leaked. The security team had already located the cause of the incident at 4:43 p.m. on the same day. At 9.42 p.m., the legal team reported it to the location of the subject concerned.

The next day, after completing the repair of loopholes, segregation of services and security checks, we set out a plan to resume cash transfers.

How hackers faked the withdrawal instructions and removed traces.

Gracy ChenThe whole attack can be more or less split into steps.

First, hackers use a zero-day loophole in third party security products to steal our internal network vouchers and access key management systems inside the platform.. As the identity documents used by the assailant are authentic, they are recognized as normal login.

In the second step, the aggressor used the stolen high-authority vouchers to enter the wallet-related backend service and directly wrote into the wallet system a false withdrawal order that was executed as a normal cash withdrawal, bypassing the risk verification process prior to the creation of the withdrawal record and thus transferring funds from the hot and warm purses.

The third step is to clear the tracks.Every time a transfer is made, the assailant removes records that may have been left behind by a false withdrawal order, attempts to cover up the attack and makes it more difficult to locate the root causes. Without direct evidence, we must conduct a broader system-checking exercise, and the restored validation process needs to cover more systems, so the entire investigation and recovery process takes some time.

Throughout the process, the attackers did not use common viruses or malicious software, but instead used authentic documents to disguise the attack as a routine operation and to remove traces once it had been completed. In our view, this was a very high-level targeted attack.

The attack was carried out by hackers using third-party safety product loopholes to steal internal documents and impersonate them. Further investigations were facilitated by Mandiant and slow fog, and we will not speculate about the identity of the assailant until official reports are made, hoping that the investigation report can be published within a week.

How the Protection Fund covered $388 million in losses

Thank you for the printing.Hello, I'm Shi Jia-Soo, head of Bitget Grand Central China.

Gracie has just described the basics of the incident. We have already completed a more thorough retrospective, using loopholes in third-party security products, stealing internal network access documents, deceiving cash orders to wallet systems, executing and bypassing wind control checks, and finally completing unusual transfers.

Throughout the process, the attackers did not use common viruses or malicious procedures, but rather used authentic identification documents and routine operations to disguise them while removing traces. After the incident, we ruled out the possibility of losing our private key. The incident was caused by the breaking of critical back-end systems in the wallet infrastructure.

The third-party security team, Slow Mist and Mandiant, is currently assisting the investigation.

Many users are also asking whether the protection fund will be replenished when it is used. The answer is yes. When the protection fund was established in 2022, we promised to keep at least $300 million a month for fast-track secure user assets in the event of a black swan.

Why would a cash withdrawal need to be restored in stages?

Thank you for the printing.Because of the large number of chains and currencies involved in this case, each chain needs to complete a core verification of multiple stages before it can be restored, so we have adopted a phased and orderly approach to recovery.

First, the Bitcoin withdrawal was opened and then the assets associated with the Taifung and networks such as Etheleum, BSC, Arbitrum, Base and Optimism were restored, then the USDT was restored and finally the other currencies and French currencies of the entire platform were restored.

All users, including institutional clients, VIP customers and ordinary customers, use the same cash route, with no one having priority. The original minimum cash withdrawal and 24-hour maximum cash withdrawal levels are also maintained. Users do not need to perform extra operations, and the platform will be displayed directly after recovery.

This is a suspension of about three and a half days, and many people ask why it takes so long. The main reason for this attack is that the key back-end system in the infrastructure involved the entire cash flow. We do not want to continue to expose potential risks until each chain is cleared and validated.

In addition, this involved multiple main networks and a variety of assets, each chain requiring separate repair and security certification, so that recovery had to be phased in along the chain and asset lines.

It is important to emphasize that the suspension has nothing to do with the adequacy of funds, when the Bitget Protection Fund was approximately $464 million in size and had an asset reserve rate of 127 per cent, all of which were transparent and accessible.

How Bitget fixes the loophole and adjusts the wind control

Thank you for the printing.: This is followed by a description of the progress made in rehabilitation and wind control.

First of all,♪ We've been ♪Isolation of affected systemsAll the servers involved are isolated from the network to prevent the attacks from continuing to spread, while preserving evidence for subsequent traceability.

SecondWe're...Internal vouchers have been reset and more sensitive privileges tightened.All internal login vouchers have been cancelled and reissued, so that the documents previously stolen by the attackers are no longer valid.

Third♪ We've been ♪Informing the third party safety vendor of the details of the gaps and assisting with analysis and repair. We stop using the function until the restoration is complete.

FourthWe're...Further enhancement of the reconciliation of cash withdrawals, all of which require independent validation。

Now that the events are under control, no new unauthorized transfers have been detected. The affected systems have been isolated and the loopholes have been repaired, but a number of core security checks still need to be completed before each chain is recovered.

How to reduce the risks posed by third-party safe products

Thank you for the printing.: Bitget, eight years after its establishment, was the first security accident and for the first time such an event had occurred. It also struck us with a very heavy alarm: how to reduce similar risks later, how to detect them earlier and cut them off faster?

First, we will apply stricter evaluation criteria before introducing third-party safety products. Second, strengthening security measures and containment mechanisms during the deployment phase of third-party products to remedy possible systemic deficiencies in third-party products themselves. Third, further improving unusual surveillance to ensure the availability and stability of alerts while increasing the accuracy of alarm judgements and reducing miscalculation and leakage.

Asked if there had been a third-party audit and penetration test. We've done it all the time, and every year security tests are conducted with agencies like Hacken.

We have also announced a white hat reward scheme. If we can help to freeze the money of an attacker, we can get a 5% reward for that money; if we can directly help recover it, we can get a 5% reward for that money.

How much can be recovered from stolen funds?

Thank you for the printing.: Some ask us how likely we are to recover, for example, 30%. Frankly, we're not so optimistic.

In the case of security incidents on other trading platforms in the past, even after a year, the proportion of assets frozen and actually recovered may be very limited. These attackers are professional and know how to transfer and confuse funds.

This is precisely why user protection funds exist. The fund has been in operation for four years, and we are committed to maintaining a minimum of $300 million in order to ensure that users’ assets can be secured quickly under similar circumstances.

Every trading platform that monitors the address, every steady money distributor at the frozen address, and every cross-chain bridge is compressing the attackers’ financial exports. With the $388 million stolen, we will not assume how much can be recovered, but we will try to track it down and recover it, thanks very much for the assistance of the trading platform, the public chain, and the project.

Because the incident involved a third-party safety product loophole, we are conducting a joint investigation with Mandiant and Slow Mist in the hope of issuing a full security report within one week.

Billing problem after recovery.

Gracy Chen: Now that the Bitcoin withdrawal has been restored, I would like to explain why some users may not have arrived for the time being.

The first part is a platform-to-work process. It usually takes several minutes for the user to generate an order from App or a web-end to pack it and broadcast it on the platform. If TXID already appears, it means that the transaction has been broadcast into the blockchain network, which can be checked in real time through the blockchain browser. If no TXID exists, the order is still being processed on the platform.

The second part is the processing of bitcoin networks themselves. Bitcoin networks are relatively slow and target blocks are about 10 minutes away, but may actually range from a few minutes to several minutes. Users are often waiting for at least one block to be confirmed after they have been released from Bitget to other trading platforms.

Therefore, if TXID already exists but is not available for the time being, it may be awaiting confirmation from the Bitcoin network and does not mean that the withdrawal remains at Bitget.

Thank you for the printing.There are now users who have been able to provide feedback on the money, and more of them have already been approved and are packing. If you are slow, wait. We also have about five times more hands today to handle the cash.

Gracy Chen: Currently, the whole of the withdrawal is functioning properly and more than 6000 requests have been received for over 2,700 bitcoins, with no significant backlog. The first two or three thousand withdrawals have been confirmed by block chains.

As recovery continues, we also open up BTC through the BSC network. Bitcoin is relatively slow and expensive, and the BSC is faster and less costly, so users can now choose different networks according to need.

Follow-up data show that the number of cash withdrawal orders we received increased further to over 6,800, corresponding to about 3300 BTCs. Some of them have been confirmed by at least one block, while the rest have been broadcast and obtained TXID, awaiting confirmation on the chain.

Why asset recovery is not the main way to secure users

Gracy Chen: For this loss, we will not use the recovery of stolen assets as the main way to secure user funds.

The reality is that recovery of stolen assets is difficult, especially in the face of highly professional hackers who are familiar with money-laundering and asset transfer patterns. So user asset security cannot depend on whether or not money can eventually be recovered from the attackers, which is why Bitget set up a protection fund.

Asset recovery reward schemes are designed to make it as difficult as possible for attackers to handle funds. If trading platforms, stable currency distributors and cross-chain bridges jointly refuse to process the relevant funds and freeze suspicious addresses, the aggressor will be able to choose fewer exports.

But whatever the eventual recovery, we will safeguard the assets of users by protecting the Fund, rather than waiting for the recovery to be followed up on the loss of users.

Gracy ChenThis time we will use the protection fund to cover the losses, so we will use part of the original $400 million protection fund. We will replenish the protection fund to over $300 million in less than a week.

The additional assets will remain in the public purse and the user can verify them in real time on the chain.

It was the first security accident in eight years of its existence. There is no technology, network, or software that will never be broken. We are very sorry about this. The most important thing next is to complete repairs, take the damage and continue to raise safety standards.

If this incident loses some of the users' trust in us, we hope to win it back through action.

Is there a third-party safety firm to be held accountable?

Gracy ChenThe user asked whether the third party safety products involved were liable and whether we would seek compensation from the other party.

This issue requires further discussion by the legal team. Although there are gaps in third-party products, we have a responsibility as a trading platform.

This is similar to the logic of recovering stolen assets. Whether it is a reward scheme or working with the industry as a whole to make hacking more difficult, we will not use them as a precondition for compensating and protecting users.

The report of the independent investigation is expected to be published within a week.

Updates of the current data and summary of events

Gracy Chen: Last update. As of 50 minutes UTC+8 16, we received 7683 bitcoin cash orders corresponding to 3609 bitcoins. Of these, 6946 were confirmed by at least one block, corresponding to 3326 bitcoins; and 737 were broadcast and awaiting confirmation on the chain, corresponding to 283 bitcoins.

The first bitcoin withdrawals were smooth and did not show a significant backlog. Apart from the Bitcoin main network, we received some orders through BSC, which is also smooth at present.

This is the first security incident in the eight years since Bitget was founded. According to current investigations, the main reason for the attack is a third-party safety product gap, with more details disclosed in independent security reports.