Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach

* Bitget restarted Bitcoin withdrawals four days after unauthorized transfers.
* Unauthorized transfers totaled approximately $387.5 million from hot and warm wallet infrastructure.
* Bitcoin network withdrawals reopened at 08:00 UTC on September 28 after security checks.
* The incident was detected on September 24 when security systems flagged unauthorized transfers.
* The affected amount was revised to approximately $387.5 million after identifying Zcash and TRON transfers.
* Cold wallets were unaffected, and user account balances remained intact.
* A flaw in a third-party security product provided the attacker with high-level internal credentials.
* An investigation involving Mandiant and SlowMist continued.
* The investigation identified the attack path and fixed the underlying vulnerability.
* Ether withdrawals are next, scheduled for September 29 on Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism networks.
* Tether (USDT) withdrawals follow on September 30 on Ethereum, BNB Smart Chain, Solana, and TRON.

The narrative centers on the failure of layered security protocols, specifically highlighting the risks introduced by reliance on external components, as evidenced by the compromise stemming from a third-party security product. The mechanism suggests that achieving high levels of operational control was contingent upon a single point of failure in access management, which, once breached, allowed for unauthorized transactional execution across diverse assets like Bitcoin, Zcash, and TRON. This shifts the focus from simple external hacks to systemic supply chain vulnerabilities within the security architecture itself. The staggered recovery schedule, focusing on specific asset classes sequentially, suggests an attempt to manage operational risk incrementally rather than a monolithic response. The ongoing nature of the investigation and the absence of finalized details regarding the attacker's identity or full scope imply that the immediate public notification is designed to establish control while deferring definitive judgment. The question then becomes: how do centralized entities maintain true cognitive sovereignty when their security posture relies on systems outside direct, immediate control, and what responsibility exists for vetting these dependencies?
Bridge Questions: If a system relying on external product credentials is compromised, where does the locus of accountability shift between the vendor, the integrating institution, and the end-user? What frameworks are necessary to evaluate third-party risk in high-value infrastructure deployments, and how can recovery strategies be designed to prioritize systemic integrity over phased service resumption?