Bitget's $388 Million Zero-Day Hack: What Happened Next

Bitget lost about $388 million after attackers exploited a zero-day in a third-party security product on September 24. The attackers used the flaw to slip fraudulent withdrawal commands into Bitget's wallet system. Funds were pulled across chains, from Ethereum and XRP to Zcash. Bitget CEO Gracy Chen says test transfers stayed under risk thresholds before the main attack. Bitget made the call to switch wallets back on mid-attack and sweep hot and warm funds into cold storage. The exchange's protection fund, built in 2022, covered users, and reopened withdrawals showed an early net inflow. Tether, Circle and NEAR Intents froze funds. THORChain declined Chen's request, and only $632K is frozen so far. Chen also says scammers impersonating an investment firm targeted her after the hack. The case raises a question for DeFi: Chen argues that "permissionless doesn't mean neutral." ZachXBT's shift on the Bitget hack and his earlier pump-and-dump claims are also noted. The hackers were able to transact even after withdrawals were paused. The question of whether an IPO is still on after the hack also remains.