Cryptocurrency exchange Bitget has disclosed that hackers made away with assets worth about $351.6 million after gaining unauthorized access to part of its wallet infrastructure.
The exchange said the security breach was detected at about 18:31 UTC on Thursday, September 24, after its systems flagged unauthorized transfers from some of its hot wallets.
Following the discovery, Bitget said it activated its emergency response protocols and temporarily suspended withdrawals as a precaution.
However, deposits and trading activities remained operational.
In an initial security notice signed by Bitget CEO, Gracy Chen, the exchange said the attack was limited to parts of its hot and warm wallet layers.
It stressed that its cold wallets were not affected by the incident.
“Estimated funds affected: approximately $351.6 million,” Bitget said.
The exchange also assured customers that their funds were safe, saying the loss would be covered by its User Protection Fund.
According to Bitget, the fund currently holds more than $464 million, which is above the estimated value of the assets lost in the attack.
“User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million,” the exchange said.
Providing further details in a subsequent update, Chen said the attackers compromised a critical backend system connected to Bitget’s wallet infrastructure.
She explained that the hackers used the compromised system to manipulate transaction data and trigger the exchange’s authorization process to transfer the funds.
“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” Chen said.
Chen added that investigations had ruled out the compromise of private keys.
She said Bitget had also contained the incident and prevented further unauthorized transfers.
“Private key compromise has been ruled out, this excludes the more severe risk scenarios. Loss containment is confirmed. No further unauthorized transfers are possible,” she said.
The exchange, however, said investigations were still ongoing to determine exactly how the attackers gained access to the backend system.
Bitget said it would release a full technical report after the findings had been confirmed.
ETH, XRP, BNB Among Affected Assets
The exchange later disclosed that the stolen assets included Ethereum (ETH), XRP, BNB, Avalanche (AVAX), Tether (USDT), USD Coin (USDC) and other tokens.
The affected assets were spread across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base networks.
Chen said all on-chain cold wallets had been checked and confirmed to be secure.
“All on-chain cold wallets have been confirmed secure and unaffected,” she said during a livestream with users.
According to her, Bitget had also contacted the foundations of the affected blockchain networks, with some confirming that wallet addresses linked to the attackers had been frozen.
Bitget Suspects North Korean Hackers
On the identity of the attackers, Chen said Bitget’s analysis had found similarities between the attack and methods previously associated with North Korean hacking groups.
“Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations,” she said.
She added that the exchange had reported the incident to relevant authorities and was cooperating with a global investigation.
Chen also clarified that Bitget Wallet, the company’s decentralized wallet product, was not affected by the attack.
“Bitget Wallet operates completely independently from Bitget exchange infrastructure, and this incident has no impact on it whatsoever,” she said.
Bitget said several technical teams were working to fix the affected systems and strengthen its security infrastructure.
However, the exchange said it would not provide a timeline for the restoration of withdrawals until a definite timeframe had been confirmed.
“Our goal is to complete a full recovery as soon as possible. We will announce the specific time window immediately upon confirmation. We will not commit to timelines we cannot deliver on,” Chen said.
The exchange said it had also notified law enforcement agencies and blockchain security firms as it continued efforts to contain the incident and recover the affected assets. Bitget had earlier promised to provide hourly updates on the situation and publish a full incident report covering the root cause of the breach and corrective measures within 24 hours.
