# Bitget Says Attackers Spoofed Transaction Data to Move $351.6 Million Out of Its Hot Wallets

Chief executive Gracy Chen says the attackers never stole private keys. Instead, a compromised backend fed Bitget's own authorization system falsified transfer instructions that it approved, and Chen says the intrusion's IP addresses point to a North Korean group.

- Published: 2026-09-25T05:49:08.849Z
- Canonical: https://polylog.news/crypto/2026-09-25/bitget-says-attackers-spoofed-transaction-data-to-move-351-6
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says), [CoinDesk](https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe), [crypto.news](https://crypto.news/bitget-probe-points-to-backend-breach/), [Bitcoin Magazine](https://bitcoinmagazine.com/news/bitget-suffers-352-million-hack), [Polylog editors](https://polylog.news)

Bitget, one of the largest centralized crypto exchanges by volume, says attackers took $351.6 million from its hot and warm wallets after compromising the backend system that feeds withdrawal instructions to its signing infrastructure. Independent on-chain researchers flagged unusual outflows before the exchange confirmed them, and Bitget [suspended withdrawals](https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe) while it investigated.

The mechanism matters more than the amount. Chief executive Gracy Chen said the attacker did not obtain private keys but instead [spoofed transaction data and triggered the exchange's own authorization process](https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says), so the signing system approved transfers that appeared legitimate. That is a failure of the controls that sit in front of the keys, not of the cryptography protecting them. Bitget says its offline cold wallets were untouched, that it retains control of its wallets, and that the loss [falls within its user protection fund](https://crypto.news/bitget-probe-points-to-backend-breach/), which it puts at more than $464 million. How the attacker first reached the backend remains under investigation.

The stolen balance spans nine assets, the largest being roughly 102.93 million XRP worth about $157.5 million and 31,890 ether worth about $85.8 million, according to Bitget's accounting relayed by CoinDesk. Chen later said the IP addresses used in the intrusion match virtual private networks associated with a North Korean group, an attribution [reported by Cointelegraph](https://t.me/cointelegraph/72313) and repeated by Watcher Guru. No independent blockchain analytics firm has confirmed the claim yet, and the attribution also serves Bitget's interests. Framing the loss as the work of a state-linked attacker makes it look unavoidable, rather than the result of weak internal controls.

Read against the exchange's own balance sheet, the disclosure functions as a solvency statement as much as a security one. Bitget is asserting that the shortfall is covered from its own capital and that customer balances are unaffected, a claim that only withdrawals at scale can test. Total value locked across decentralized finance stands at $95.03 billion, according to DeFiLlama, so the exchange lost an amount equal to roughly a third of one percent of all on-chain collateral in a few hours.

## What this means

The loss did not come from broken cryptography. It came from a trusted internal system that behaved exactly as designed once an attacker controlled its inputs, a failure surface that audits of smart contracts and key management do not cover. Exchange customers are exposed through counterparty risk rather than protocol risk, and rival venues gain if Bitget's withdrawal queue stalls. Traders holding the nine affected assets face selling pressure if the attacker sells the stolen funds rather than holds them, with XRP the largest single position.

## What to watch

- Whether Bitget restores unrestricted withdrawals and how quickly, since a prolonged pause would be the clearest sign that the shortfall is harder to absorb than the exchange states.
- Whether Chainalysis, Elliptic or TRM Labs publish independent tracing that supports or contradicts the North Korea attribution, since that determines how much weight regulators give the exchange's account.
- Movement of the stolen XRP and ether into mixers or cross-chain bridges, which would indicate laundering rather than an attempted negotiated return.