Bitget executive says private key leak and insider involvement have been ruled out

Bitget Chinese-language regional head Xie Jiayin said in a livestream reviewing the incident that the attacker exploited a vulnerability in a third-party security product to steal internal network access credentials and forge withdrawal instructions to the wallet system. According to Xie, the forged requests were able to trick the wallet into executing abnormal transfers that had passed risk checks, which ultimately allowed the attack to succeed. He said the attacker did not rely on common viruses or malware during the operation. Instead, the intruder allegedly used real identities and routine operations and maintenance procedures throughout the process to disguise activity and erase traces, which Xie described as a relatively sophisticated targeted attack. Xie also said Bitget has completed its internal review after the incident and has fully ruled out the possibility of a private key leak as well as any insider involvement. He added that the hacker took advantage of a flaw in a third-party security product, stole Bitget’s internal credentials, and impersonated identities to carry out the attack.