Bitget lost $351.6 million in a single night. According to the exchange’s CEO, the attackers never reached the vault keys. Instead, they broke into the office that handles the paperwork.
“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” Bitget CEO Gracy Chen said in a post on X. “Private key compromise has been ruled out.”
That last sentence is the most important part of her statement. If it survives the technical report she has promised, it changes how this breach should be understood.
Why it matters that the private keys were safe
Some of the industry’s largest losses have come from stolen private keys. A breach that left them untouched points to a less alarming way in.
Each crypto wallet has two keys. The public key is like a bank account number: you can share it so others can send you funds. The private key is a secret string that proves you own the wallet and lets you spend from it. It works like a password and a vault combination in one.
Anyone who copies a wallet’s private keys can keep signing new transfers until nothing is left. Chen said that is not what happened at Bitget.
Fake slips at the teller window
Chen likened the attack to someone passing forged withdrawal slips through a bank’s own teller window. The vault keys stayed inside the building. The attacker got into the office where the slips are prepared, created paperwork that looked genuine, and sent it through the same approval window the bank uses every day.
To the system approving it, the request looked like a routine payout. That is the uncomfortable part. Bitget’s authorization process did exactly what it was built to do. The problem is that it trusted data it should not have trusted.
It is still unknown how the attacker got into that backend system. “Loss containment is confirmed. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation. A full technical report will follow once confirmed,” Chen said.
The hot wallets were hit first, then the warm layer
At 18:31 UTC on Sept. 24, Bitget’s systems detected unauthorized transfers from some of the exchange’s hot wallets. A hot wallet stays connected to the internet so funds can move quickly. For an exchange, it is a short-term liquidity hub, a bit like an online cash drawer that handles instant trades, deposits and withdrawals.
The attack went further. Chen said it also reached the warm-wallet layer. This is a partly connected buffer between the automated hot wallets and cold storage, which is kept fully offline. The warm layer tops up the hot wallet when its balance runs low and moves surplus deposits offline so that too much capital is not left exposed.
Chen said Bitget’s cold wallets, the exchange’s offline vault, “remain fully secure.”
A $464 million backstop
According to Chen, Bitget’s User Protection Fund holds more than $464 million, which is enough to cover the entire loss. If the fund pays out the full $351.6 million, a little over $112 million would remain.
“User funds are safe,” Chen said. “Your account balances are accurate and your assets are protected.”
Reassurance is easy to offer after a hack. The thing users can actually verify is what the exchange lets them do right now. Deposits and trading are still running. Withdrawals are not.
No return date for withdrawals
Bitget has suspended withdrawals “as a precautionary measure, pending security review.” Chen gave no timeline for when they will resume.
“Multiple technical teams are working in parallel on system remediation and security hardening,” Chen said. “We will announce a timeline as soon as one is confirmed,” she said, adding: “we will not commit to a window we cannot guarantee.”
That answer is honest, but it is frustrating for anyone with coins still on the platform. They can deposit and trade, but they cannot withdraw.
If you hold funds on Bitget, the fact that deposits are open does not mean things are back to normal. Before you send any new money, wait for Chen’s promised technical report and a firm date for withdrawals.