Bitget’s $387.5 million security incident resulted from attackers manipulating the exchange’s transaction-signing workflow rather than stealing private keys, according to an independent September 26 analysis by GoPlus Security. The firm said forged backend data caused Bitget’s own signer to approve valid on-chain transfers from some hot and warm wallets. Cold storage and the separately operated Bitget Wallet were not affected. Bitget initially estimated the loss at $351.6 million before adding $35.9 million in Zcash and TRON transfers from the same attack window. GoPlus reconstructed a multi-chain drain from 18:58 to 21:23 UTC on September 24, including an approximately $185 million wave in one minute. Bitget said user balances were not altered and that the shortfall was covered by its User Protection Fund, which exceeds $464 million. Withdrawals are scheduled to resume in phases from September 28, beginning with Bitcoin. The exchange has said it fixed the weakness, while Mandiant and SlowMist continue investigating the entry point and possible attacker attribution.