Hackers siphon $351.6m from Bitget wallets

Cryptocurrency exchange Bitget says hackers made away with about $351.6 million after gaining unauthorised access to a critical backend system connected to part of its wallet infrastructure.

The exchange detected suspicious transfers from some of its hot wallets at about 18:31 UTC on Thursday, September 24, and immediately activated its emergency response procedures.

Bitget CEO, Gracy Chen, said preliminary investigations showed that the attackers did not compromise the exchange’s private keys or cold-wallet holdings.

Instead, the attackers allegedly breached a backend system, manipulated transaction information and exploited the authorisation process to transfer assets out of affected wallets.

“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” Chen said.

Bitget temporarily suspended withdrawals following the incident while leaving deposits and trading services operational.

The exchange said its cold wallets remained secure and that the financial impact was covered by its User Protection Fund, which it said contained more than $464 million.

“User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund,” the exchange said.

The stolen assets reportedly included Ether, XRP, BNB, Avalanche, USDT, USDC and other tokens spread across several blockchain networks, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base.

Chen later confirmed during a livestream that all on-chain cold wallets had been verified as secure.

Bitget said it had contacted the foundations of the affected blockchain networks, with some reportedly confirming that addresses associated with the attackers had been frozen.

The exchange is also investigating the identity and method of the attackers. Chen said preliminary analysis of IP behaviour and on-chain activity showed similarities with patterns previously associated with North Korean hacking groups.

She stressed that the assessment remained part of the ongoing investigation and said Bitget had reported the incident to relevant authorities and was cooperating with a wider international investigation.

Bitget Wallet, the company’s decentralised wallet service, was not affected by the breach, according to Chen.

“Bitget Wallet operates completely independently from Bitget exchange infrastructure, and this incident has no impact on it whatsoever,” she said.

The exchange said its technical teams were working on remediation and additional security measures before restoring withdrawals, but declined to give a specific timeframe.

Chen said the company would only announce a restoration window after it had been confirmed.

Bitget also said it was working with law enforcement agencies and blockchain security firms to trace the stolen assets, contain the breach and pursue recovery options.

The exchange promised regular updates and said a detailed incident report covering the root cause and corrective measures would be released after the investigation.