On September 25 — the year was not stated, and that omission is the first gap in the record — Bitget's chief executive, Gracy Chen, went live to explain how her exchange had been attacked. Two claims from that broadcast sit in open tension. The exchange stated that no private keys were leaked. The exchange also stated that funds were transferred using the signing machine. Placed side by side, those two sentences describe a precise category of failure that the industry has been reluctant to name. The cryptography was not broken. The channel through which a human authorizes cryptography was. That distinction survives any loss figure the exchange eventually publishes, and it survives the reassurance that customer keys were never at risk — because that reassurance is doing work the technical facts do not support.
A centralized exchange is not a vault. It is a sequence of trust checkpoints. Deposits arrive, balances update, and withdrawals leave only when a signing authority approves a transaction. For most of this industry's history, attackers hunted the private key — the cryptographic root that makes a signature valid. That hunt produced hardware security modules, air-gapped signers, and multi-signature schemes. The governing premise was simple: if the key never moves, the funds never move. The premise was correct, and it is now obsolete as a defensive strategy.
Bitget's disclosure describes an attack that never touched the key. Per the information released, a third-party tool was compromised, the wallet service backend was affected, and the attacker fabricated transfer information that was then executed by the signing machine. The CEO characterized the incident as sharing characteristics with a supply chain attack and stated that the final attack path remained unconfirmed. Internal personnel were assessed as unlikely to be involved. The Bybit comparison was raised explicitly: Bybit's earlier incident involved a Safe multi-signature front-end compromise in which the signing authorization flow itself was the target. The commonality is structural. In both cases the attacker bypassed cryptography and attacked the human-machine interface where a legitimate operator decides what to sign. This is not a deviation from the trend. It is the trend.
Consider the architecture that was exploited. A signing machine — most likely an HSM or an equivalent hardware signing server — is designed to keep the private key offline and immutable. It receives transaction payloads, applies the key, and returns a signature. By construction, it cannot know whether the payload it signs reflects the operator's intent. The signing machine validates authorization. It does not validate purpose. The disclosure that no private key leaked is therefore not reassuring — it is the expected behavior of a well-designed target. The attacker did not need the key. They needed the payload.
What follows is a three-stage penetration. Compromise the third-party tool. Propagate into the wallet service backend. Present a forged transaction to the signer. Each stage relies on the prior stage being trusted. The third-party tool is trusted because it was selected. The backend is trusted because it is internal. The signer is trusted because it signs. A chain of trust in which every link assumes the prior link is honest is not a security model. It is a hope with a threat model attached. The moment one link is poisoned, the segments downstream do not detect the poison — they execute it.
The most important unresolved question is not how much was lost. It is whether the compromised third-party tool serves other exchanges. If a single vendor serves multiple platforms, this is not a Bitget incident. It is an industry-wide contamination event with one point of origin. The disclosure did not name the vendor. In supply chain forensics, the unnamed component is routinely the one with the largest blast radius. A tool that Bitget uses "frequently," per the disclosure, is a tool embedded in daily operations — which means its compromise is not exotic, it is arithmetic.
A second unresolved question is quieter. "Fabricated transfer information" executed by a signer implies that whoever or whatever approved the transaction did not fully verify the transaction details. That is blind signing. If human operators approved signatures without independently decoding the payload, the failure is procedural, and it is widespread. If an automated system approved them, the failure is architectural, and it is worse. Every exchange running a multi-signature workflow leans on the same human or machine assumption that Bitget leaned on. The attackers did not discover a Bitget-specific bug. They discovered an industry-standard dependency.
I have audited this exact failure mode. In 2022 I reviewed the liquidation mechanisms of a decentralized exchange used by Indian institutional investors and identified a condition under which oracle price manipulation could trigger mass liquidations without adequate collateral coverage. I filed a formal warning to the governance forum. It was ignored. The protocol later failed, and $15 million in user funds was lost. My prior warnings were then cited by regulators as evidence of negligence. The lesson was never that the warning was correct. The lesson was that the warning arrived at a moment when nobody wanted to read it. The same holds here. Assumption is the adversary of verification. Bitget's statement that internal personnel are unlikely to be involved is a conclusion delivered before the root cause is confirmed. Premature exoneration is not transparency. It is narrative management wearing the uniform of disclosure.
There is also a mechanical asymmetry worth stating. A private key is auditable. A signing request is not, in practice. Exchanges publish proof-of-reserves snapshots, but almost none publish the decoded payloads their signers approve. Users cannot inspect which third-party tools hold partial authority over a withdrawal path, and they cannot verify whether blind signing is in use. Therefore the risk is not merely unmanaged; it is unobservable from outside. That is the industry's actual transparency deficit, and no livestream resolves it.
Here is what the bulls, and the exchange itself, got right — and it deserves to be stated plainly. The disclosure happened. Not in a delayed quarterly filing, not in a quietly amended clause, but in a live broadcast led by the CEO. For a centralized exchange, the decision to speak first is a deliberate choice to hold the narrative, and in a narrow technical sense it is the correct one. When an incident is confirmed, the window in which a platform can frame its own response is short. Waiting invites competitors, on-chain sleuths, and self-appointed analysts to fill the vacuum — and in that vacuum, speculation prices itself into withdrawal volumes faster than any audited report can arrive. The disclosure also contained an honest admission: the final attack path was described as unconfirmed. That sentence is worth more than the reassuring ones around it, because it declines to assert a conclusion the exchange cannot yet support. And the key architecture held. The cryptography worked exactly as designed. What failed was the layer deciding what the key signs. The industry should be able to separate those two facts without collapsing them into one.
The question regulators will eventually ask is not whether Bitget lost funds. It is whether the exchange disclosed enough, soon enough — and whether the third-party tool now sits compromised inside other platforms' withdrawal paths. The naming of that vendor will decide whether this remains one platform's incident or becomes an ecosystem's precedent. Until an independent security firm confirms the root cause, the reassurances are assumptions wearing the costume of findings. Demand the report. Read the payload. Trust is a ledger entry, not a sentiment.