Cryptocurrency exchange Bitget lost $351.6 million after attackers exploited a compromised backend system to spoof transaction data and trigger the platform's authorization process, CEO Gracy Chen confirmed. The company ruled out a private key compromise.
Chen wrote on X that the attacker "used [the compromised backend] to spoof transaction data" and "triggered our authorization process to move funds out." She added that "private key compromise has been ruled out" — a distinction that separates this incident from several of the industry's largest losses, which have typically involved stolen private keys.
Every crypto wallet uses two keys: a public key, which functions like a bank account number for receiving funds, and a private key, which serves as the secret credential required to authorize spending. If a private key is copied, an attacker can continuously sign and execute transfers. Chen characterized the breach as analogous to slipping forged withdrawal slips through a bank teller window — the vault keys never left the building, but someone gained access to the office that prepares paperwork and routed it through the same approval channel.
The breach came to light when Bitget's systems flagged unauthorized transfers from hot wallets at 18:31 UTC on Sept. 24. A hot wallet remains connected to the internet to support rapid transaction processing. Chen confirmed the attack also reached the warm-wallet layer, a semi-connected buffer that top ups hot wallets and pulls excess deposits offline to limit exposure. Bitget's offline cold wallets, however, "remain fully secure," she said.
The company has stopped further unauthorized transfers. "Loss containment is confirmed. No further unauthorized transfers are possible," Chen wrote, adding that the specific method of system intrusion remains under active investigation and a full technical report will follow once confirmed.
Bitget said its User Protection Fund, which holds more than $464 million, would cover the full loss. "User funds are safe," Chen wrote. "Your account balances are accurate and your assets are protected."
Deposits and trading remain open, but withdrawals have been suspended pending a security review. No timeline was given for their resumption. "Multiple technical teams are working in parallel on system remediation and security hardening," Chen said. "We will announce a timeline as soon as one is confirmed — we will not commit to a window we cannot guarantee."
