Bitget CEO Gracy Chen said an attacker exploited a zero-day vulnerability in a third-party security product to obtain high-privilege internal credentials and issue fraudulent withdrawal commands, moving assets ultimately valued at about $388 million from hot and warm wallets. The exchange said private keys and cold wallets were not compromised, user balances were unaffected, and its User Protection Fund will absorb the loss rather than relying on asset recovery. Bitget said it identified and fixed the vulnerability, isolated affected systems, reset internal credentials and strengthened sensitive-access and withdrawal checks. Mandiant and SlowMist are assisting with forensic analysis and on-chain tracing, while Bitget has offered recovery rewards and said it aims to publish an independent security report within a week.