Bitget hacked: $351 million stolen from hot wallets

The crypto exchange Bitget has fallen victim to a major hack in which attackers siphoned off more than $351 million in cryptocurrencies from the platform’s hot wallets. CEO Gracy Chen says that the cold wallets are intact and that user funds are fully covered by the exchange’s protection fund. She currently points to North Korean hackers as possible perpetrators, although this has not yet been confirmed with certainty.

In brief:

• Hackers stole $351.6 million in cryptocurrencies from Bitget’s hot wallets, including ETH, XRP, BNB and USDT.
• Bitget is covering the losses through a protection fund of more than $464 million; withdrawals have been temporarily blocked.
• CEO Gracy Chen currently points to North Korean hackers and compares the situation to the Bybit hack earlier this year.

Hackers bypass signing process without stealing private keys

On 24 September at 14:31 Eastern Time, Bitget detected unauthorised transfers from a number of hot wallets. The affected amounts and assets almost immediately moved to an external address beginning with 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. Arkham Intelligence showed that these involved large amounts in ETH, USDC, USDT and gold token XAUT.

An initial technical investigation by the security team shows that attackers breached a critical system in the backend of the wallet service. This allowed them to forge transfer information and trigger the authorised signing process without actually possessing the private keys. Theft of private keys has now been ruled out as an attack vector.

The affected assets include ETH, XRP, BNB, AVAX, USDT and USDC, among others. According to analyst Darkfost, XRP was the largest loss on a single blockchain.

CEO compares attack to Bybit hack

Bitget CEO Gracy Chen confirmed the hack in an official statement and indicated that the exchange’s protection fund, which contains more than $464 million, is more than sufficient to cover the losses. In addition, Bitget holds more than $1 billion in its own capital. Withdrawals have been temporarily suspended, but deposits and trading continue as normal. Bitget has reported the suspect addresses to the authorities and to specialised on-chain security firms.

During a livestream, Chen drew a parallel with the hack on Bybit, in which $1.5 billion was lost earlier this year. She stated that Bitget, with a retail business of a similar size to Bybit’s, can also absorb a loss of more than $300 million. The CEO further noted that certain IP addresses closely match VPN patterns associated with a North Korean hacking group, but definitive confirmation of the attackers’ identity is still lacking.

Bitget Wallet unaffected, users warned about phishing

Bitget Wallet, the self-custody wallet that operates separately from the exchange, has said it was not involved in the incident. User assets in that wallet are on-chain and remain under the user’s own control. Bitget Wallet’s services are continuing as normal.

Bitget promises to provide an update every hour and to publish a full incident report within 24 hours, including an analysis of the cause and the measures being taken. Ethereum is currently at $2.680, virtually unchanged from a day earlier.