Bitget detected unauthorized wallet transfers at 18:31 UTC on Sept. 24, about 30 minutes before attackers began moving hundreds of millions of dollars. Hypernative’s reconstruction found that $87.6 million left hot wallets (online wallets used for active transactions) at 19:01 and $202.8 million left warm wallets (connected wallets with added security controls) at 19:16. The two bursts took a combined 24 seconds and represented about three-quarters of the $387.5 million Bitget said was transferred to attacker-controlled addresses. Bitget said a backend wallet-infrastructure system was compromised, withdrawal data was spoofed and its authorization process was deceived, while private keys were not compromised. Hypernative said the transactions were signed by Bitget’s own wallets and resembled ordinary customer withdrawals. The firm identified independent transaction matching, parameter checks, velocity limits and automatic signer suspension as controls that could have disrupted the attack. Attacker-linked transfers continued until 21:23 UTC, almost three hours after detection. Bitget said it remediated the vulnerability and reported no further unauthorized transfers after containment; Mandiant and SlowMist remain involved in the forensic investigation.