Bitget said attackers exploited a vulnerability in an external security product to obtain internal authentication credentials and use them to submit fraudulent withdrawal instructions. The exchange said the instructions bypassed risk controls and triggered abnormal transfers, but no private keys were leaked and its cold wallets were unaffected. Bitget has disclosed the attacker addresses and related on-chain tracking data and plans to complete its internal security report this week.