BITGET SAYS PRIVATE-KEY COMPROMISE IS RULED OUT AND COLD WALLETS WERE UNTOUCHED — THE ATTACKER USED A THIRD-PARTY SECURITY PRODUCT TO GET CREDENTIALS AND SIMPLY ASKED THE WALLET SYSTEM TO SEND — 9,585 REQUESTS TOOK 4,098 BITCOIN OUT IN THE FIRST HOUR, THREE QUARTERS OF THE PROTECTION FUND

Bitget says its private keys were never compromised. The forensic work has ruled that out, and the cold wallets across every chain came through untouched. By the usual way of telling these stories, that is the good news.

Here is what happened instead. Someone found a hole in a third-party security product, used it to get high-level internal credentials, and then sent the wallet system withdrawal commands. The system did what it was told. It had no way to know the difference between an instruction from Bitget and an instruction from someone holding Bitget's credentials, because at that layer there is no difference. Key custody was never the weak point. Authorization was.

That is worth sitting with, because most exchange security is sold on the key story. Cold storage, multisig, hardware modules, air gaps. All of it protects the key. None of it protects the path between a credential and a signing request. Bitget bought a third-party product to make that path safer and the product became the way in.

Customers did their own arithmetic. Bitcoin withdrawals reopened at 08:00 UTC on 2026-09-28 and within the hour 9,585 requests took about 4,098 coins off the platform, roughly three quarters of the 5,500 bitcoin sitting in the Protection Fund that is supposed to cover the loss. The official security report was promised for the week of 2026-09-28 and has not arrived. At the time of this writing, bitcoin was $83,618.