Bitget says $351.6 million hack hit wallet backend, withdrawals remain suspended

Dubai: Crypto exchange Bitget says hackers breached a critical backend system within its wallet infrastructure to carry out approximately $351.6 million in unauthorised transfers, while withdrawals remain suspended as technical teams work on repairs and additional security checks.

The exchange said the attacker was able to spoof transaction data and trigger its authorisation process to move funds out, according to an update from Chief Executive Gracy Chen.

Private key compromise has been ruled out, Bitget said, while the company has also confirmed that the loss has been contained and there is no risk of further unauthorised transfers from the platform.

“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” Chen said.

“Private key compromise has been ruled out — this excludes the more severe risk scenarios. Loss containment is confirmed. No further unauthorized transfers are possible.”

Withdrawals remain temporarily unavailable, while deposits and trading continue to operate.

Bitget said multiple technical teams are working in parallel on system remediation and security hardening, with preparations to restore withdrawals also underway.

“We will announce a timeline as soon as one is confirmed — we will not commit to a window we cannot guarantee,” Chen said.

The exchange has not provided a firm date or time for withdrawals to resume.

Bitget’s official withdrawal notice says the service will be restored once the security review is completed, while deposits and trading remain available.

Bitget first detected the unauthorised transfers at 18.31 UTC on September 24 and activated its emergency response procedures within minutes.

The company estimates that approximately $351.6 million was affected.

Bitget operates a three-layer wallet system and said the breach was confined to portions of its hot and warm wallet infrastructure. Its cold wallets were not affected.

“User funds are safe. The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million,” Chen said.

The company said customers’ account balances remain accurate and their assets are protected.

Abnormal transfer addresses have been identified, flagged and reported, while law enforcement agencies and on-chain security firms have been brought into the investigation.

While Bitget says it has identified the part of its infrastructure that was compromised, the specific method used by the attackers to gain access remains under technical investigation.

The company had initially said it would not speculate on the attack vector until its investigation was complete.

A full technical report is expected once the investigation has established the details of the intrusion.

Bitget has also said it will continue publishing updates on the incident through its official channels while work continues to restore withdrawals.

Blockchain analytics platform Lookonchain said about $183 million of the stolen funds had been swapped for Ether, according to the background information provided.

Bitget was founded in 2018 and has 120 million registered users, according to the company’s website.