Why
The Bitget hack ($387.5M, 2026-09-24) wasn't a key leak — it was a supply-chain attack. Compromised third-party software led to stolen admin-backend credentials, which were used to push forged withdrawal commands: a small test withdrawal first, then multiple hot wallets drained in under 20 minutes.
I wanted to understand the mechanism well enough to rebuild both the attack and the defense, so I did.
What's in it
Matching engine — price-time priority order matching, the kind of thing that comes up in systems-design interviews at exchange-style companies.
Withdrawal defense — three independent layers modeled on what actually would have stopped Bitget:
- Velocity check (flags request bursts in a short window)
- Multi-approval (large amounts can't clear on one admin's authority)
- Timelock (large withdrawals are delayed, not instant)
There's also a TWAP oracle demo reproducing the Tectonic hack (Cronos, 2026-08-30) — a ~100x price pump used to borrow against inflated collateral.
Try it
Everything runs in the browser against fake data — never a working exploit.
- Live demo: https://breachlab-5xg.pages.dev/en/
- Source: https://github.com/goalsgo1/breachlab
What's next
A new incident gets added only if it passes three checks: the mechanism is explainable in 3 steps or fewer, it's safely reproducible with fake data, and it's being actively discussed. Not a product for real exchange operators — this is a learning resource and portfolio project.
Feedback welcome.
Top comments (0)