Bitget: authority after orchestration compromise

This note asks one bounded question: after a wallet-orchestration path is compromised, what evidence shows that the authority capable of producing the external effect has actually been revoked?

It is not market analysis, attacker attribution, a solvency assessment, a penetration test, or a reconstruction of Bitget’s undocumented private architecture. Company findings are attributed to Bitget. Mandiant and SlowMist findings are attributed to their reports. XRP Ledger observations are used only for what the ledger can establish.

Detection was not one event

Bitget’s initial notice and Mandiant’s September 28 status report place detection of unauthorized outbound transfers at about 18:31 UTC on 24 September 2026. Bitget’s later incident timeline separately places a 19:05 UTC event at which its reconciliation system detected a significant discrepancy and the risk-control system automatically blocked withdrawal requests across the platform.

Those statements should not be collapsed into one timestamp. They describe different observations and controls: detection of unauthorized effects at 18:31, then a reconciliation discrepancy and a platform withdrawal-request block at 19:05.

Bitget’s later timeline places the highest-level emergency response at 19:14, containment measures beginning at 19:40, and shutdown of wallet withdrawal services including signing services at 21:44.

Sources: Bitget initial notice, Bitget later timeline, Mandiant status report.

What the forensic reports establish

SlowMist’s progress report says the earliest malicious activity found in the available logs dated to 31 August on a node of third-party security Product A. It reports a zero-day vulnerability in a service, hidden-script execution under that service process, an attempt to read an environment variable containing a database password, and direct database access. It also reports similar hidden-script activity on two other nodes on 23 and 25 September.

SlowMist says that in the early hours of 25 September UTC+8, the attacker accessed Product B’s management platform using an internal employee identity, attempted command injection through task parameters, used a web execution endpoint, and later deployed malicious program files. SlowMist also says it recovered a deleted, highly customized withdrawal tool tailored to the wallet system’s withdrawal logic. The report says the tool forged risk-control parameters, constructed withdrawal requests, and invoked the withdrawal process.

Mandiant’s September 28 status report says a threat actor gained unauthorized privileged access to third-party security appliances A and B, deployed a web shell on appliance B, established command-and-control, moved laterally to Bitget’s production wallet job server, and deployed malicious packages. Mandiant describes its findings as preliminary and its investigation as ongoing.

These are forensic-report findings. They do not establish a public product/vendor identity, a CVE, an internal human accomplice, or a private-key compromise. Bitget separately says private-key compromise was ruled out.

Sources: SlowMist progress report, Mandiant status report, Bitget incident page.

What the XRP evidence can establish

BitEvo MatrixOut’s preserved XRP evidence records an attacker-directed transfer of 91,420,942.755708 XRP at 19:16:20 UTC and another of 9,306,865.8 XRP at 21:19:21 UTC. It also records a failed attacker-directed attempt at 20:28:20 and an internal Bitget transfer at 20:40:02.

Relative to Bitget’s later 19:05 reconciliation/block event, the 19:16:20 transfer occurred 11m20s later and the 21:19:21 transfer 2h14m21s later. The 21:19:21 transfer occurred 24m39s before Bitget’s stated 21:44 shutdown of wallet withdrawal and signing services.

The inspected XRP transactions also showed the same on-chain SigningPubKey values for the respective Bitget accounts and the same LastLedgerSequence - ledger_index = +998 construction pattern seen in reviewed normal operations.

Those observations are useful for transaction construction and effect timing. They are not cryptographic signing timestamps. They do not identify the internal initiator, prove private-key compromise, prove or disprove off-chain MPC/TSS, or prove a named “kill switch” failed.

Sources: BitEvo MatrixOut evidence pack; XRPL common transaction fields; XRPL finality.

The authority lesson

The defensible lesson is not “the kill switch failed.” Public evidence does not establish such a mechanism or its scope.

The stronger lesson is: a control state is only meaningful if it is bound to the object and action that can still produce the external effect.

Bitget’s public timeline says withdrawal requests were automatically blocked at 19:05. The forensic reports describe compromise reaching wallet-related backend execution. The public ledger records attacker-directed XRP effects after 19:05. These statements can coexist because a customer-facing request block and a downstream wallet execution path are not necessarily the same authority surface.

Evidence Before Effect

After control-plane or orchestration compromise, an internal “blocked” state is evidence about one control. It is not, by itself, proof that the external effect has stopped. Verify the effect surface.

External Confirmation

When effects land on an independently observable system, use that system to confirm whether effects continue. A validated XRPL result can establish that a transaction succeeded or failed. It cannot establish human intent or the exact signing time.

Object / action binding

A stop decision should identify the exact object, action class, authority owner, and downstream executors whose authority is being revoked. “Withdrawals stopped” is weaker than evidence proving which execution paths can no longer submit, authorize, sign, or release effects.

Recovery after compromise

Recovery is not the alert firing or a block being set. Recovery requires evidence that the compromised effect path has lost authority, followed by fresh validation before authority is restored.

What this evidence does not establish

This note does not establish insider involvement, attacker identity, solvency, private-key failure, MPC/TSS failure, or kill-switch failure. It does not infer Bitget’s undocumented internal authority graph. Ledger inclusion time and transaction fields do not reveal exact signing time or the internal initiator.

The narrow conclusion is about control design: after orchestration compromise, prove authority revocation at the effect path rather than treating an upstream block or incident-response state as sufficient evidence.