Bitget CEO Discloses Initial Attack Path: May Involve Third-Party Software Supply Chain Attack

Bitget CEO Gracy Chen stated during a live stream regarding the platform’s attack incident that the security team is currently focused on identifying the root cause and resolving the issue. Based on information available at this stage, the incident resembles a supply chain attack: attackers likely compromised a third-party tool frequently used by Bitget, thereby affecting a critical backend system of its wallet service. Chen noted that the compromised service forged transfer information and invoked a signing machine to siphon funds. The incident did not involve a private key leak; according to current investigations, the possibility of an insider job is also low. However, she added that the final attack vector still requires further confirmation from the security team. She further explained that hacker attacks are rarely single-type, with a single attack typically combining two to three of six to seven different tactics. Citing Bybit’s previous attack incident as an example, she noted that the case involved both the signature authorization process and a supply chain attack targeting the Safe multisig page it used. Common attack methods against crypto exchanges also include private key leaks, smart contract vulnerabilities, insider jobs, and social engineering attacks.