$387.5 million. Gone. Not one line of compromised Solidity. No reentrancy callback, no oracle manipulation window, no forged bridge message. The attack surface was a login.
That is the entire story, and it is the part most coverage buries. Bitget disclosed the attack path behind its $387.5M breach and restarted Bitcoin withdrawals this week. The mechanics, according to the exchange's own CEO Gracy Chen, trace back to a third-party vulnerability that leaked internal credentials. Code does not lie, but it often omits the context. Here the context is that the exploited layer was never code at all — it was trust.
In late 2017 I spent four weeks manually auditing Solidity contracts for reentrancy because that was where the money slept. In 2026 the money moved. The vulnerability did not follow it. It stayed exactly where the humans are: in the credentials, the vendors, and the permission tables nobody reads until the postmortem is already being drafted.
The $387.5M number is a headline. The credential leak is the finding.
Context: What a Centralized Exchange Actually Is Beneath the UI
A centralized exchange is not one system. It is a stack of custody guarantees pretending to be a single product. To understand how a third-party flaw drains a balance sheet, you have to see the layers.
At the top sits the matching engine and the deposit/withdrawal front end. Below that sits the ledger — an internal database that records what the exchange owes you. It is not the blockchain. It is an IOU table, and it is authoritative until someone reconciles it against on-chain flows. Below the ledger sit the actual keys: hot wallets for liquidity, warm wallets for batch operations, and cold wallets that are supposed to be unreachable from the internet.
In a mature exchange, moving $387.5M worth of assets should require crossing several independent boundaries. A withdrawal request should pass a risk engine. It should be signed by a threshold of key holders — multisignature or MPC — not by a single private key. It should respect per-window limits. And the credentials that touch any of these systems should be hardware-bound, least-privilege, and rotated on a schedule that does not depend on a calendar reminder.
The industry repeatedly claims these controls exist. The industry repeatedly discovers they are a diagram in a compliance deck rather than a constraint in a running system.
Bitget is a major exchange with real operational depth. Its Bitcoin withdrawal channel is live again. That matters, and I will come back to why the restart is being misread. But the disclosed attack path tells us which control failed first, and it is not the one security teams rehearse for.
Core: Reconstructing the Path from a Vendor Flaw to a Custody Loss
Here is the sequence as it can be logically reconstructed from what Bitget released. A third-party service — the kind of upstream dependency every exchange integrates but rarely audits — was compromised. Through that compromise, internal credentials were extracted. Those credentials were then used inside Bitget's perimeter, not against the blockchain. The chain itself performed exactly as designed. It moved assets to wherever the credentials authorized.
The key inference is directional: the attacker did not break Bitget's cryptography. The attacker borrowed Bitget's authority.
That distinction changes the entire threat model. A cryptographic break would be catastrophic and, statistically, rare. An authority break is mundane, repeatable, and cheap. You do not need to factor a curve. You need an API key, a session token, or a service account with write access to a wallet or its approval queue.
When I reverse-engineered price feeds across five lending platforms in 2020, the finding that actually protected my team was not exotic. It was that everyone had copied the same oracle integration pattern, and the pattern trusted data that could be delayed. The vulnerability was structural, not cryptographic. Supply chain credential compromise is the same genre of failure one layer up the stack. It is not an edge case. It is the default mode.
Let me tabulate what the disclosure implies against what a mature CEX should enforce. The gaps are where the money is.
| Control layer | Best-practice requirement | What a credential leak implies | |---|---|---| | Vendor access | Scoped, expiring tokens; no shared secrets | A third-party path reached internal systems | | Credential binding | Hardware keys, device attestation | Credentials were usable outside their origin | | Wallet signing | MPC/threshold, not single-key | Possibly one authority could initiate movement | | Approval flow | Multi-party, time-delayed | Loss magnitude suggests limited friction | | Segregation | Cold funds unreachable from hot path | Hot liquidity was reachable and drained |
Read the table again. Every row is a place where a strong guarantee becomes a weak one the moment a credential lands in the wrong hands. The exchange's security is only as strong as the least-scoped token in its supply chain.
Now, the second-order question. Why $387.5M and not the whole treasury? Because even a compromised credential operates inside whatever limits the system enforces. The number itself is a clue about how much friction existed. If a single credential could move the entire balance sheet, the attacker would have. The breach reached $387.5M, which implies a boundary held somewhere — a per-window limit, a hot-wallet ceiling, or a manual approval that eventually gated the flow. That is cold comfort, but it is data. It tells you the difference between a partial loss and an existential one was, in part, an operational limit rather than a cryptographic one.
The mechanics of "internal credentials"
The phrase "internal credentials" is doing a lot of work in the official statement, and it should be interrogated. In a CEX environment, that phrase can mean several very different things, each with a different blast radius.
It can mean API keys — the same class of credential that retail traders generate to run bots. If a vendor or an employee had an API key with withdrawal permissions enabled, that is a self-inflicted architecture choice. API keys with withdrawal scope are a footgun. There is almost no legitimate reason for one to exist with tight IP allowlisting and no 2FA binding.
It can mean service-account credentials for infrastructure — cloud IAM roles, database replicas, message queues. These rarely move funds directly, but they let an attacker move laterally toward systems that do. I said the attacker probably did not break the core chain infrastructure. The more likely pattern is peripheral entry, then horizontal traversal, exactly the kind of path that a vendor flaw opens.
It can mean wallet-layer authority — signing rights, approval rights, or a backend admin role. If a leaked credential could place a withdrawal request and the human approval step was either absent or satisfiable by the same compromised identity, the cryptography never got a chance to defend.
It can mean session or 2FA-adjacent material. I have written before that the weakest link in institutional custody is frequently not the key but the ceremony around it. A single compromised session, if it can reach the right console, is worth more than a stolen cold-storage shard that has no path to the network.
The disclosure did not name which of these was leaked. It did not need to for the vulnerability to be real. The important fact is that the attacker crossed from a trusted third party into the trust boundary without being detected at the crossing.
Why the Bitcoin withdrawal restart is not a healing signal
Here is where public interpretation is drifting off the evidence. The restart of Bitcoin withdrawals is being read as recovery. Technically, it is a liquidity and operations decision, not a security clearance.
Restarting withdrawals proves one thing: Bitget can currently satisfy Bitcoin redemptions. It does not prove the $387.5M gap is closed. It does not prove the compromised credential path is sealed. It does not prove the third-party dependency has been remediated. It proves the faucet works today.
When a bridge team dismissed my cross-chain findings in 2022 because I was junior, the flaw I reported was also in the part of the system that "was working." It was working because nobody had exercised the path in production yet. Availability is not integrity. A system answering requests is not a system that is sound.
I would expect the restart to come with friction: tighter per-account withdrawal caps, additional manual review, and longer latency. That friction is the honest signal. If withdrawals resume at pre-incident speed with no visible tightening, that is not reassurance. It is either a re-architected flow or a surface-level reseal over the same credential-permission model.
Where ZK actually fits — and where it does not
I work on zero-knowledge verification, so I will be precise about what this event does and does not have to do with it. ZK does not stop a stolen API key. A proof of correctness for a withdrawal is worthless if the party submitting the withdrawal is authorized by a credential that was compromised upstream. Cryptography secures the claim, not the claimant.
The place ZK and its cousins genuinely help is in proof of reserves and proof of solvency — proving that the custody layer holds what the ledger says without exposing individual positions. This is the work I did designing a privacy-preserving compliance layer in 2025, verifying user solvency without exposing transaction history. That architecture can tell the market whether a gap exists. It cannot tell the market whether the attacker still has a valid token.
So the industry's reflex to reach for ZK after every CEX incident is half right. It addresses transparency. It does not address authority. You need both: the proof that the books reconcile, and the assurance that the only identities who can move funds are the ones you intend.
Contrarian: The Real Risk Was Never the $387.5M
The herd is pricing the loss. The board should be pricing the possibility that the loss is not fully covered.
The bear market has a specific gravity here. In an expansion, a $387.5M hole can be papered over with reserves, insurance, and a liquidity backstop while confidence holds long enough for the narrative to fade. In a contraction, every dollar of that hole is a solvency question, and every user asks it at the same moment. A withdrawal restart on a known funding gap is a liquidity event dressed as a recovery.
Here is the contrarian read: the most damaging outcome is not the theft. It is the disclosure asymmetry that follows.
Bitget's CEO went public with the attack path, which is a genuine transparency improvement over the silent-response playbook. But transparency about the vector is not transparency about the coverage. The market has been told how the door was opened. It has not been told how much of the room is empty. Those are different disclosures, and only the second one determines solvency.
There is a broader blind spot, and this is the one that should keep other exchanges awake. A third-party credential compromise is not Bitget-specific. It is a shared architecture. Every CEX integrates upstream services — cloud, KYC, risk, custody tooling, notification, analytics. Every one of those integrations is a trust edge. If one exchange can lose $387.5M through a vendor path, the same path exists, unaudited, elsewhere. The event is not a Bitget event. It is an industry control failure with a logo on it.
And the disclosure itself is unverifiable by outsiders. There is no independent on-chain forensics in the release, no third-party audit, no regulatory filing to cross-check against. That does not mean the statement is false. It means it is unconfirmed, and in a custody event, unconfirmed is a risk category of its own.
Takeaway: What to Watch Next
The vulnerability forecast is not complicated. Watch the reconciliation, not the announcement.
If Bitget publishes reserves that cover user liabilities and the gap closes with tracked recovery, the incident collapses to a case study and fades inside a quarter. If the gap persists — if the reserve statement is delayed, qualified, or replaced with rhetoric — the narrative escalates from "security event" to "solvency event," and the platform token, the depth on the book, and the withdrawal queue all become leading indicators of the same thing.
For the rest of the market, the lesson is transferable in one line: audit the authority, not just the asset. Every exchange that reads this disclosure should ask which of its vendors can reach its credentials, and which of its credentials can reach its funds. If those two questions have the same answer, the next $387.5M is already sitting in a permission table, waiting for a login.
The cryptography held. The humans did not. That has been the pattern since 2017, and the market still refuses to price it.
