Bitget says third-party product flaw enabled $388 million theft

Bitget says the attacker who stole about $388 million from its cryptocurrency exchange exploited a flaw in a third-party security product to obtain high-level internal credentials. The account adds an entry point to Bitget's earlier disclosure that its wallet backend had been compromised. On September 24, the attacker used those credentials to send fraudulent withdrawal commands that the wallet system treated as legitimate. Bitget says the stolen funds came from hot and warm wallets, while cold wallets and customer account balances were unaffected. It has isolated affected systems, replaced credentials and added withdrawal checks. The exchange has not named the security product, and its investigation remains in progress.