Just In: Hackers Steal $351.6m From Bitget Wallets, Company Calls for Calm
Cryptocurrency exchange Bitget has disclosed that approximately $351.6 million was lost after hackers gained unauthorised access to part of its wallet infrastructure.
The exchange said its security systems detected unauthorised transfers from some of its hot wallets at 18:31 UTC on Thursday, September 24, prompting it to activate its emergency response protocols.
In an initial security notice signed by Bitget Chief Executive Officer, Gracy Chen, the exchange said the breach was limited to parts of its hot and warm wallet layers, while its cold wallets remained secure.
“Estimated funds affected: approximately $351.6 million,” Bitget said.
Bitget said withdrawals were temporarily suspended as a precaution, while deposits and trading remained operational.
The exchange also assured users that the loss would be covered by its User Protection Fund, which it said currently holds more than $464 million.
“User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million,” the exchange said.
In a subsequent update, Chen provided further details on how the attackers moved the funds, saying a critical backend system within Bitget’s wallet infrastructure had been compromised.
“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” she said.
Chen said the investigation had ruled out the compromise of private keys and that further unauthorised transfers had been prevented.
“Private key compromise has been ruled out, this excludes the more severe risk scenarios. Loss containment is confirmed. No further unauthorized transfers are possible,” she said.
However, Bitget said the specific method used to gain access to the backend system remained under investigation, adding that a full technical report would be released after its findings had been confirmed.
The exchange later disclosed that the affected assets included ETH, XRP, BNB, AVAX, USDT, USDC and other tokens across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base networks.
“All on-chain cold wallets have been confirmed secure and unaffected,” Chen said during a livestream with users.
She added that Bitget had contacted the foundations of the affected blockchain networks, with some confirming that wallet addresses linked to the attackers had been frozen.
On the possible identity of the attackers, Chen said Bitget’s analysis had identified similarities with known North Korean hacking operations.
“Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations,” she said.
She added that the exchange had reported the incident to relevant institutions and was cooperating with a global investigation.
Chen also clarified that Bitget Wallet, the exchange’s decentralised wallet product, was not affected by the incident.
“Bitget Wallet operates completely independently from Bitget exchange infrastructure, and this incident has no impact on it whatsoever,” she said.
On the restoration of withdrawals, Bitget said several technical teams were working on system remediation and security hardening but that it would not announce a timeframe until one had been confirmed.
“Our goal is to complete a full recovery as soon as possible. We will announce the specific time window immediately upon confirmation. We will not commit to timelines we cannot deliver on,” Chen said.
Bitget said it had also notified law enforcement agencies and on-chain security firms while pursuing available channels to contain the incident and recover the affected assets.
The exchange said it would provide hourly updates and publish a full incident report, including its root-cause analysis and corrective actions, within 24 hours.
Source: The Punch