THE FIRST UNAUTHORIZED TRANSFERS OUT OF BITGET WERE 0.184 ETH AND 193 TRX AT 18:31 UTC ON 2026-09-24 — BOTH SAT BELOW THE EXCHANGE’S RISK-CONTROL THRESHOLD AND TRIGGERED NO SYSTEM ALERTS — GRACY CHEN TOLD THE BLOCK THE ATTACKER TESTED THE LINE BEFORE MOVING $388 MILLION

Gracy Chen told The Block how the Bitget theft actually started. At 6:31 in the evening UTC on September 24, two transfers left the exchange. One was 0.184 ether. One was 193 TRX. Both sat below the risk control threshold and nothing fired.

Read that again, because it is the whole lesson. The alarm was built to care about size. So the attacker sent an amount too small to care about, confirmed the alarm would stay quiet, and then moved 388 million dollars. The control did exactly what it was configured to do, and that is precisely why it failed.

Bitget says private keys and cold wallets were never compromised. That is true and it is beside the point. The attacker did not need keys. A zero day in a third party security product got him into an internal management system where he could insert withdrawal commands, and the system honored them because the system was the thing being trusted.

Every exchange runs a threshold like this one. Coins you leave on any of them are guarded by a number somebody picked and by software from a vendor whose name you have never heard. That is the trade, and it is worth knowing you are making it. At the time of this writing, bitcoin was $83,475