Attackers stole about $388 million from Bitget after gaining access to third-party security products nearly four weeks before funds moved, then using a custom withdrawal tool to make the exchange accept unauthorized transfers. Interim findings by SlowMist and Google Cloud's Mandiant found no evidence that Bitget's private keys were leaked and said its cold wallets were unaffected. Bitget restored Bitcoin, ETH and USDT withdrawals and planned to resume all-token withdrawals on Friday. Chief Executive Officer Gracy Chen said the exchange's protection fund would absorb the loss, although Bitget's reported fund balance differs between accounts: more than $464 million at the time of the incident in its earlier disclosure and $309 million in Chen's later statement. SlowMist traced the earliest logged malicious activity to Aug. 31, when attackers exploited a zero-day vulnerability in an unnamed product, retrieved a database password from an environment variable and accessed the database. Similar activity was detected on Sept. 23 and Sept. 25. The first verified on-chain transfer occurred at 6:31 p.m. UTC on Sept. 24, with transfers continuing for about 2 hours and 52 minutes across multiple blockchains. Arkham Intelligence found that $228 million moved in 18 minutes across seven chains, including about $153 million in XRP. The exchange has not ruled out insider or North Korean involvement; SlowMist's MistTrack unit identified suspected North Korean operators using CoW Protocol and Chainflip, while wallets linked to the attack transferred about $3.8 million worth of ZEC to the Ironwood pool. Bitget launched separate 5% bounties for freezing and recovering funds, but Chen said she was not very optimistic about recovering the full amount.