# Bitget Says Attackers Spoofed Transfer Data in Backend System to Take $351.6 Million

Chief executive Gracy Chen says the signing process approved forged instructions rather than leaking private keys, and the loss would consume about 76% of the exchange's $464 million protection fund.

- Published: 2026-09-25T13:11:38.958Z
- Canonical: https://polylog.news/crypto/2026-09-25/bitget-says-attackers-spoofed-transfer-data-in-backend-syste
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says), [CryptoSlate](https://cryptoslate.com/bitgets-north-korea-linked-352-million-hack-could-drain-76-of-its-protection-fund/), [Bitcoin Magazine](https://bitcoinmagazine.com/news/bitget-suffers-352-million-hack), [Polylog editors](https://polylog.news), [CNBC](https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html)

Bitget lost $351.6 million after attackers compromised a backend wallet system, generated forged transfer instructions and pushed them through the exchange's own authorization and signing process. Chief executive Gracy Chen [described the breach in a public account of the incident](https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says). Her central claim is that private keys were not stolen. The signing system worked as designed: it approved instructions that appeared valid because the system feeding it data had already been compromised.

The exchange says hot wallets absorbed the losses while cold wallets remained untouched, that it has restored wallet control, and that its User Protection Fund covers the amount, [according to statements relayed by market news channels](https://t.me/BWEnews/16490). Deposits and trading continue. Withdrawals remain suspended while engineers rebuild the affected systems, and Chen said restoration could take hours or days rather than weeks, [per CNBC's account](https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html). CryptoSlate calculates that covering the full estimate from a fund valued near $464 million [would leave roughly $112 million](https://cryptoslate.com/bitgets-north-korea-linked-352-million-hack-could-drain-76-of-its-protection-fund/), below the floor Bitget has publicly stated for the fund.

Attribution remains unconfirmed. Chen said the exchange identified internet addresses whose virtual private network usage patterns match those associated with a North Korean group, while stressing that the link is [not confirmed](https://t.me/cointelegraph/72313). Blockchain analysts and Bitcoin Magazine tracked [unauthorized transfers across multiple chains](https://bitcoinmagazine.com/news/bitget-suffers-352-million-hack) before the exchange confirmed the total loss. The North Korea framing benefits Bitget in a specific way: attributing the breach to a state intelligence operation casts the exchange as the target of a national security matter rather than of an internal operational failure, and it also opens the door to law-enforcement and stablecoin-issuer cooperation on freezing the stolen funds.

The mechanism described here has drained the largest sums from exchanges over the past two years. The cryptographic keys held. The infrastructure that tells the keys what to sign did not.

## What this means

The failure surface here is the operational pipeline that constructs withdrawal instructions, not the cryptography that signs them, and the exposed parties are Bitget's customers (whose withdrawals are frozen), the exchange's insurance reserve, and any venue that relies on a similar backend-to-signer trust path. A well-documented precedent is the February 2025 Bybit breach, also attributed by investigators to North Korea-linked operators, where the compromise sat upstream of the signing step and the exchange restored withdrawals quickly while rebuilding reserves from revenue and external loans. The likelier outcome is that Bitget reopens withdrawals within days and replenishes the protection fund out of trading income over the following months, while custody teams across the industry expand security reviews to cover transaction-construction infrastructure that audits of on-chain code never touched. The condition is that the $351.6 million figure holds. Evidence that would prove the read wrong: a materially larger loss estimate, a prolonged withdrawal freeze, or confirmation that cold-wallet keys were also exposed.

## What to watch

- Whether Bitget publishes a technical post-mortem naming the compromised backend component, which would tell other exchanges whether the weakness is vendor software or bespoke code.
- Whether Tether and Circle freeze any of the traced stablecoin balances, the clearest signal of how much of the theft is actually recoverable.
- Bitget's reported protection-fund balance once withdrawals resume, which shows whether self-insurance was replenished or simply redefined.