Bitget has confirmed that roughly $388 million was stolen from its hot wallet, with attackers gaining a foothold inside a compromised server on August 31 — nearly four weeks before the theft was discovered. The exchange brought in blockchain security firm Slowmist on September 25 to investigate. The gap between intrusion and detection is the part that should worry every exchange operator reading this.
The server breach came first
The attack didn't start with a wallet. It started with a server. Attackers ran code inside that compromised machine on the last day of August, according to the facts of the case, and then waited. Nearly a month passed. The hot wallet was drained. Nobody noticed for weeks.
That timeline is the uncomfortable detail here. A hot wallet is the part of an exchange's treasury that stays connected to the internet so customers can move funds in and out. It's the most exposed piece of the stack by design, and it's also the piece that most needs round-the-clock monitoring. A breach that runs from the end of August into late September without triggering a halt suggests either the detection layer wasn't watching the right signals, or the attacker moved slowly enough to stay under the threshold.
Slowmist brought in on September 25
Bitget engaged Slowmist, a blockchain security firm, on September 25 to investigate. That's the only outside party named in the facts so far. What Slowmist has found, and whether the stolen funds have been traced, hasn't been disclosed.
For a loss of this size, the forensic work matters in two directions. First, tracing where the $388 million went — which wallets, which mixers, which bridges. Second, figuring out how the server was compromised in the first place so the same entry point doesn't get reused. Exchanges that have been through this before tend to publish a post-mortem within weeks. Bitget hasn't yet.
What Bitget customers are dealing with
Deposits and withdrawals are the immediate question for anyone with funds on the platform. The facts don't say whether Bitget paused either, so there's no way to confirm one way or the other here. What is clear is that the exchange is operating under the assumption that a hot wallet — the liquidity customers actually touch — was compromised for an extended period.
That's a different animal from a cold-storage breach, where customer funds are largely insulated. A hot wallet hit means the money that was supposed to be available on demand is what walked out the door.
The detection gap is the real story
Four weeks is a long time in crypto. Long enough for a dozen on-chain monitoring tools to flag unusual outflow. Long enough for any exchange with a functioning security operations center to notice a hot wallet balance drifting. The fact that it took until September 25 — when Slowmist was brought in — to escalate tells you the internal alerting either missed it or was ignored.
There's no word yet on whether Bitget has reimbursed affected users, whether it's pursuing recovery through law enforcement, or whether the compromised server has been fully isolated. Slowmist's investigation is the next concrete thing to watch. Until that report surfaces, the $388 million question is simple: how did a server breach on August 31 turn into a wallet drain that nobody caught for nearly a month?
