Bitget lost $351.6 million without a key leak; withdrawals have no reopening time
No key leak. A backend wallet system was breached, the signing process was triggered, and withdrawals have no reopening time.
Bitget said about $351.6 million in assets left its hot and warm wallets without approval.[1] It found 19 transfers; cold wallets stayed safe.[2]
The attacker broke into a key backend wallet system, faked transfer data and set off the exchange’s signing process.[3] Chen said private keys were not the way in.[4]
Assets hit were ETH, XRP, USDT, USDC, Avalanche and BNB on Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum.[5]
SlowMist MistTrack added seven newly flagged XRP Ledger addresses holding about 102,926,478 XRP, worth about $157 million.[6]
Withdrawals stayed shut while deposits and trading kept going.[7] Money can still go in and cannot yet come out. Chen said there is no exact time yet for bringing them back.[8] The User Protection Fund holds more than $464 million and covers the loss.[9]
Cold wallets held; the signing process did its job.[2]
Who gains, who loses
Receipts
Bitget reported approximately $351.6 million in affected digital assets after unauthorized transfers from parts of its hot and warm wallet infrastructure.
“Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.”
Bitget detected 19 unauthorized transfers from portions of its hot and warm wallet infrastructure, while its cold wallets remained secure.
“Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen.”
Bitget's security team found that the attacker breached a critical backend wallet system, spoofed transfer information and triggered the exchange's authorization-signing process.
“The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process.”
Bitget CEO Gracy Chen said the incident did not involve a private-key compromise.
“Private key compromise has been ruled out,” she said.”
The affected assets included ETH, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks.
“Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks.”
SlowMist MistTrack reported seven newly flagged XRP Ledger addresses holding approximately 102,926,478 XRP, worth about $157 million.
“SlowMist MistTrack has updated the Bitget hacker wallet addresses, adding 7 newly flagged Ripple network addresses with a combined balance of approximately 102,926,478 XRP, worth about $157 million.”
Bitget suspended withdrawals while deposits and trading continued normally.
“Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally.”
Bitget CEO Gracy Chen said the attack did not use key leakage and that there was no exact timeline for restoring withdrawals.
“Bitget CEO Gracy Chen stated during a public livestream regarding the platform attack that the platform is currently preparing to resume withdrawals, but there is no exact timeline yet.”
Bitget said its User Protection Fund, holding more than $464 million, fully covered the reported loss.
“The company maintains that customer balances are accurate and that the loss is fully covered by its User Protection Fund, which holds more than $464 million.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.