Bitget, one of the world’s top ten crypto exchanges by trading volume, suffered a revised loss of between $387.5 million and $388 million after attackers exploited a vulnerability in a third-party security product on September 24. The breach enabled spoofed transaction data to pass through the exchange’s authorization process, although private keys were not compromised and cold-storage wallets remained untouched. Bitget recorded $463 million in outflows on September 29, the largest single-day withdrawal event tracked by DefiLlama in four years. The exchange holds roughly $5.7 billion in reserves, making the loss about 6.8% of total holdings. It began a phased resumption of withdrawals on September 28 and used its User Protection Fund to absorb user losses. That fund, which exceeded $464 million before the breach, has reportedly fallen below $200 million. CEO Gracy Chen said initial forensic indicators point to North Korean threat actors, specifically the Lazarus Group, with Mandiant and SlowMist assisting the investigation.