Bitget Says Attackers Spoofed Transfer Data in Backend System to Take $351.6 Million

Bitget lost $351.6 million after attackers compromised a backend wallet system, generated forged transfer instructions and pushed them through the exchange's own authorization and signing process. Chief executive Gracy Chen described the breach in a public account of the incident. Her central claim is that private keys were not stolen. The signing system worked as designed: it approved instructions that appeared valid because the system feeding it data had already been compromised.

The exchange says hot wallets absorbed the losses while cold wallets remained untouched, that it has restored wallet control, and that its User Protection Fund covers the amount, according to statements relayed by market news channels. Deposits and trading continue. Withdrawals remain suspended while engineers rebuild the affected systems, and Chen said restoration could take hours or days rather than weeks, per CNBC's account. CryptoSlate calculates that covering the full estimate from a fund valued near $464 million would leave roughly $112 million, below the floor Bitget has publicly stated for the fund.

Attribution remains unconfirmed. Chen said the exchange identified internet addresses whose virtual private network usage patterns match those associated with a North Korean group, while stressing that the link is not confirmed. Blockchain analysts and Bitcoin Magazine tracked unauthorized transfers across multiple chains before the exchange confirmed the total loss. The North Korea framing benefits Bitget in a specific way: attributing the breach to a state intelligence operation casts the exchange as the target of a national security matter rather than of an internal operational failure, and it also opens the door to law-enforcement and stablecoin-issuer cooperation on freezing the stolen funds.

The mechanism described here has drained the largest sums from exchanges over the past two years. The cryptographic keys held. The infrastructure that tells the keys what to sign did not.