Bitget Says Attackers Spoofed Transaction Data to Move $351.6 Million Out of Its Hot Wallets

Bitget, one of the largest centralized crypto exchanges by volume, says attackers took $351.6 million from its hot and warm wallets after compromising the backend system that feeds withdrawal instructions to its signing infrastructure. Independent on-chain researchers flagged unusual outflows before the exchange confirmed them, and Bitget suspended withdrawals while it investigated.

The mechanism matters more than the amount. Chief executive Gracy Chen said the attacker did not obtain private keys but instead spoofed transaction data and triggered the exchange's own authorization process, so the signing system approved transfers that appeared legitimate. That is a failure of the controls that sit in front of the keys, not of the cryptography protecting them. Bitget says its offline cold wallets were untouched, that it retains control of its wallets, and that the loss falls within its user protection fund, which it puts at more than $464 million. How the attacker first reached the backend remains under investigation.

The stolen balance spans nine assets, the largest being roughly 102.93 million XRP worth about $157.5 million and 31,890 ether worth about $85.8 million, according to Bitget's accounting relayed by CoinDesk. Chen later said the IP addresses used in the intrusion match virtual private networks associated with a North Korean group, an attribution reported by Cointelegraph and repeated by Watcher Guru. No independent blockchain analytics firm has confirmed the claim yet, and the attribution also serves Bitget's interests. Framing the loss as the work of a state-linked attacker makes it look unavoidable, rather than the result of weak internal controls.

Read against the exchange's own balance sheet, the disclosure functions as a solvency statement as much as a security one. Bitget is asserting that the shortfall is covered from its own capital and that customer balances are unaffected, a claim that only withdrawals at scale can test. Total value locked across decentralized finance stands at $95.03 billion, according to DeFiLlama, so the exchange lost an amount equal to roughly a third of one percent of all on-chain collateral in a few hours.