The Bitget attack began with the exploitation of a vulnerability in a third-party security product, allowing attackers to obtain internal network access credentials. They then forged withdrawal instructions for the wallet system, which processed abnormal transfers that passed its risk checks. Rather than deploying conventional viruses or malware, the attackers used real identities and routine operational activity to disguise the intrusion and remove traces. Following the incident, Bitget said it had ruled out both private-key leakage and insider involvement, based on monitoring by Xie Jiayin cited by Odaily.