Bitget Confirms $351.6 Million Hack, Protection Fund Covers Losses

Bitget announced on September 24 that unauthorized transfers from its hot‑wallet infrastructure resulted in an estimated loss of $351.6 million. The exchange halted withdrawals, activated emergency procedures, and said its $464 million User Protection Fund is sufficient to cover the loss.

Timeline and Immediate Response

At 18:31 UTC on September 24, Bitget’s security systems flagged suspicious activity in several hot wallets. Within minutes the exchange froze withdrawals, identified the addresses involved, and notified law‑enforcement and blockchain‑security firms. Deposits and trading continued, and the company affirmed that customer balances remain unchanged.

Scope of the Theft

On‑chain analysis traced assets across multiple networks, including:

• ≈102.93 million XRP (about $157.5 million)
• 31,890 ETH (≈$85.8 million)
• $34.75 million USDT
• $21.05 million USDC
• $19.67 million USDT0
• 3,000 XAUt (tokenized gold)
• 12,719 BNB
• 821,012 AVAX
• 20.59 million TRX

Most of the Ethereum‑compatible assets were quickly consolidated and converted into ETH, bringing the total Ethereum‑based value to roughly 67,982 ETH.

Technical Details of the Attack

Bitget’s CEO Gracy Chen stated that private keys were not stolen. Instead, attackers allegedly compromised a backend component of the wallet infrastructure, allowing them to forge transaction data that passed the exchange’s signing process. The breach is described as a manipulation of the transaction‑authorization system rather than a direct key theft.

Speculation About the Perpetrators

Some observers have linked early IP and routing data to patterns previously associated with North Korea’s Lazarus Group, which was blamed for the $1.5 billion Bybit breach in February 2025. No definitive evidence has been released, and the attribution remains speculative.

Impact on Users and Recovery Prospects

Withdrawals remain disabled while Bitget conducts its investigation and repairs the affected infrastructure. The exchange assures users that balances are intact and that the User Protection Fund, valued at over $464 million, will absorb the loss. Recovery of the stolen assets is uncertain; stablecoins such as USDT and USDC could potentially be frozen by their issuers, while native ETH and other tokens are harder to seize.

Next Steps

Bitget has pledged hourly updates and a full technical incident report within 24 hours of the initial notice. The report is expected to detail the root cause, the exact attack vector, and corrective measures.