I Built a Test-Transfer Detector After the Bitget Hack (Paper Alerts. NFA)

Two tiny transfers, then about 30 minutes later, the big ones. Bitget's CEO told The Block that the attacker in the roughly 388 million dollar Bitget exploit first sent 0.184 ETH and 193 TRX that stayed below the exchange's risk-control threshold and raised no alert. In this video I separate what is reported from what is not confirmed, then build a small paper Python detector that flags tiny-then-big transfer sequences on SYNTHETIC (fake) logs and prints alerts only. Teaching line: test transfers are a pattern, not proof. Careful customers and treasury teams send tiny test transfers all the time. The detector scores context (admin credential or customer, change ticket, number of chains, new destination) so a pattern becomes a reason to look, not a verdict. Important: this does not claim the detector would have prevented the Bitget hack. All data in the demo is synthetic example data generated by a seeded script. It is not Bitget data and not real transactions. The detector reads a file and prints text: no network, no wallet, no keys, no signing, no transactions. What is reported (sources, checked on 2026-09-30): - The Block, Sep 28 2026: Bitget attacker tested risk controls with small transfers before 388 million dollar theft, CEO says (first unauthorized transfers 18:31 UTC Sep 24: 0.184 ETH and 193 TRX, both under the risk-control threshold; 17 larger transactions 18:58 to 20:09 UTC, about 361 million dollars; discrepancy flagged 19:05 UTC). https://www.theblock.co/news/regulation/2026-09-28-bitget-attacker-tested-risk-controls-small-transfers-388-million-theft-ceo-says-417045 - Bitget Academy, Security Incident: Timeline, Impact and Response (updated Sep 29 2026): about 388 million dollars, hot and warm wallets, private-key compromise ruled out, cold wallets not affected, phased withdrawal restart. https://www.bitget.com/academy/bitget-security-incident-what-happened-timeline-impact-response - Bitget Support Center incident update: revised total about 387.5 million dollars (from 351.6 million) after adding Zcash and TRON transfers. https://www.bitget.com/support/articles/12560603896108 - CoinDesk, Sep 25 2026: first report, 351.6 million dollars, spoofed transaction data, no private-key compromise. https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says - Decrypt: hack losses climb to 387 million dollars. https://decrypt.co/379350/bitget-hack-387m-what-happened-why-north-korea-suspect - Cointelegraph, Sep 28 2026: third-party security vulnerability; attribution indicators still being assessed. https://cointelegraph.com/news/bitget-388m-hack-third-party-security-vulnerability - The Hacker News, Sep 28 2026. https://thehackernews.com/2026/09/bitget-says-attacker-exploited-third.html Not confirmed: the test-transfer timeline comes from the CEO's interview with The Block and Bitget's formal incident report was pending; the risk-control threshold was not disclosed; the third-party security product was not named; the attacker is not confirmed (Mandiant and SlowMist are investigating). No claim here that Bitget or any exchange is unsafe. Paper only. Alerts only. LIVE=0. DRY_RUN. Not financial advice (NFA). No buy calls, no coin endorsement, no PnL claims. Chart and log data in the demo are synthetic. Bound: https://brave-green-star-frost.grok.me/ Tools: https://starkcrypto.github.io/stark-tools/ GitHub: https://github.com/StaRKCrypto X: https://x.com/StaRKCryptoBots Chapters: 0:00 Cold open: two tiny transfers 0:23 What was reported (sources on screen) 2:21 What is NOT confirmed 3:21 A pattern, not proof 4:22 Designing the detector 5:33 The synthetic logs (fake data) 6:39 Running the detector 7:33 Why not just a bigger threshold? 8:22 Where it fails 9:29 Limits: what this is not 10:31 Recap #Bitget #CryptoSecurity #Python #PaperTrading #NFA