Bitget's chief executive disclosed that the actor responsible for a $388 million theft against the cryptocurrency exchange first tested its automated risk controls through a series of small transfers before executing the full exploit, framing the sequence as a methodical reconnaissance phase.

The CEO's account portrays a deliberate probing sequence. According to the chief executive's description, the attacker validated how Bitget's risk engine responded to incremental low-value transactions — likely testing withdrawal limits, address whitelists, velocity checks and anti-money-laundering thresholds — before scaling up to the $388 million extraction.

Bitget, a centralized derivatives venue that markets perpetual-futures and copy-trading products to retail users globally, has not publicly named the specific attack vector. The exchange has not disclosed whether the compromised funds sat in a hot-wallet configuration, a multi-signature custody arrangement or a third-party managed reserve.

What the probing-phase disclosure changes

Pre-attack probing is a familiar pattern in exchange-targeted breaches. Automated monitoring tools typically trigger on absolute or relative thresholds — dollar value, transaction frequency, geographic origin — that can vary across platforms. Attackers often conduct low-value test transactions to map those thresholds before executing the substantive extraction, calibrating the eventual haul to sit just inside or outside each control.

Two questions follow directly from the CEO's account. Did Bitget's monitoring systems register the small test transfers and fail to escalate them? Or were the probes invisible to the platform's detection tooling entirely? Each answer carries different implications for compliance posture, regulatory exposure and customer-disclosure obligations.

How the loss will reach user balances

The exchange has not stated whether customer funds will absorb any portion of the $388 million loss or whether the venue will cover the shortfall from its own treasury. Centralized venues routinely draw on insurance funds, corporate reserves, or pass costs onto users through "socialized loss" mechanisms; none of these options has been publicly designated for this incident.

The architecture of the compromised pool will determine which path applies. Insurance-funded recoveries require a named policy and a verified event type. Treasury-funded absorption depends on disclosed reserves. Socialized losses require explicit user-agreement clauses, which have been contested in multiple jurisdictions.

Industry implications

A $388 million exploit ranks among the larger single-incident losses recorded against a centralized venue in recent years. The disclosure of a pre-attack probing phase is rarer still — most post-mortems surface only execution mechanics, not the reconnaissance trail — and sets a transparency baseline that competitors will be pressed to match.

The forthcoming post-mortem, the loss-allocation plan and any law-enforcement referrals will together determine the regulatory response in the exchange's registration jurisdictions and across the secondary markets where Bitget solicits users.

Forward look

Bitget's next substantive filing — a post-mortem, a law-enforcement referral, or an explicit loss-allocation plan — will set the precedent for how the $388 million is treated across user balances and establish a benchmark for how centralized derivatives venues disclose multi-hundred-million-dollar exploits.