- Published on
Bitget's $352 million hack happened via spoofed transfers, not private keys, CEO Gray Chen says
- Authors
- Name
- DeepHorus
Crypto exchange Bitget disclosed an overnight breach that moved $351.6 million in unauthorized transfers from its wallet infrastructure. The incident surfaced when the exchange’s systems flagged unauthorized activity from some hot wallets at 18:31 UTC on Sept. 24. Chief executive Gracy Chen said on X that attackers compromised a critical backend system within its wallet infrastructure. She added that the theft had been contained and that no further unauthorized transfers were possible.
According to Chen, the attacker used that backend access to spoof transaction data and trigger Bitget’s normal authorization process. She emphasized that private-key compromise had been ruled out. In her account, the incident resembled an attacker submitting forged withdrawal paperwork through a bank’s trusted internal channel rather than stealing the key to its vault. The important distinction is that the withdrawal instructions were manipulated upstream, while the secrets used to authorize cryptocurrency spending remained secure.
Every crypto wallet uses a public key to identify an account and a private key to authorize spending from it. If private keys are stolen, an attacker can create new signatures and potentially drain funds without needing continued access to the exchange. Chen said that was not the mechanism in this case. Instead, the attacker manipulated the systems that prepared, presented and processed apparently legitimate transfer requests.
The breach affected both hot and warm wallets, but Bitget said its offline cold wallets remained fully secure. Hot wallets connect to the internet so an exchange can process deposits, withdrawals and trades quickly. Warm wallets serve as a semi-connected buffer, replenishing hot wallets and moving excess funds away from internet-facing systems. Cold wallets are kept offline, providing a final layer of separation from systems that interact with external networks.
Bitget has suspended withdrawals as a precaution while specialists review the compromised infrastructure. Deposits and trading remain available, giving customers some ability to continue using the exchange despite the restrictions. The company has not announced a firm date for restoring withdrawals. Chen said multiple technical teams are working on remediation and security hardening, but that the exchange would not promise a schedule before it could be guaranteed.
Bitget said its User Protection Fund contains more than $464 million and will cover the full $351.6 million loss. According to Chen, customer account balances are accurate and user assets are protected by the fund. The reimbursement commitment limits the immediate financial exposure described in the announcement. It does not, however, resolve questions about the initial intrusion, the authorization failure or the duration of the security review.
The distinction between stolen keys and spoofed transactions is central to the exchange’s initial account of the incident. Explaining that the vault keys stayed secure may ease concerns about an attacker retaining indefinite control of customer assets, while the fund commitment offers reassurance about reimbursement. At the same time, Chen acknowledged that the precise method of system intrusion remained under investigation. She said a full technical report would follow after investigators confirmed the findings, making the forthcoming report important for understanding how the attack succeeded.
For customers, the clearest immediate consequence is a withdrawal freeze rather than a reported gap in account balances. Longer term, the incident is likely to increase scrutiny of the separation between transaction-preparation systems and systems that authorize asset movements. Exchanges operating similar architectures may also revisit access controls, transaction validation and the safeguards governing transfers out of hot wallets. The outlook remains conditional, however: containment has been confirmed, but the root cause, complete forensic findings and withdrawal restoration schedule are still unresolved.
