Bitget CEO Gracy Chen said attackers exploited a vulnerability in a third-party security product to obtain internal network credentials and privileges, then forged withdrawal instructions to the wallet system and bypassed risk controls. About $388 million in assets was transferred. Bitget said private keys were not exposed and cold wallets were unaffected. The vulnerability has been fixed and the incident is fully under control. The company will cover the entire loss through its user protection fund and replenish the fund to at least $300 million within one week after funds are used. Bitget has also begun an asset-recovery plan and will share confirmed vulnerability and attack information with relevant industry participants. The attacker’s address and on-chain tracking data have been publicly released.