Bitget says spoofed transfer instructions, not stolen keys, drained $351.6 million from its hot wallets

Bitget has given the first technical account of the September 24 theft from its wallet infrastructure, and the account matters more than the size of the loss. Chief executive Gracy Chen said the attacker compromised a backend system inside the wallet stack, spoofed transaction data and then triggered the exchange's own authorization process, rather than stealing signing keys. The exchange put the loss at about $351.6 million, detected unauthorized transfers at 18:31 UTC, and said cold wallets were untouched and that user balances remain intact. A Bitget representative said the majority of the stolen funds came from hot wallets and that its Protection Fund can absorb the loss.

The recovery picture shows how little of on-chain freezing power actually reaches a fast attacker. Circle and Tether blacklisted a wallet holding roughly $318,000 in USD Coin (USDC) and Tether (USDT), a fraction of a percent of the total. Security researcher Taylor Monahan tracked the attacker converting stolen USDC into ether before those controls took effect, and ether has no issuer that can immobilize a balance. Centralized stablecoins are the only assets in this loss that a private party can seize, and they were the first thing the attacker sold.

Attribution remains unsettled. Bitget's chief executive linked the theft to North Korean hackers, citing internet addresses resembling virtual private network infrastructure previously associated with North Korean operators and behavior patterns seen in earlier cases. That is circumstantial evidence, and Bitget has said it will not make a formal determination before its investigation closes. Investigators benefit from naming a sanctioned actor because it unlocks state assistance, and the exchange benefits from a narrative of a state adversary rather than internal process failure. Neither motive settles the question.

Withdrawals return in stages. Bitget said it will reopen bitcoin withdrawals on September 28, ether on September 29, USDT on September 30 and remaining tokens and fiat on October 2, with security checks continuing. In the interim, the custody split became visible: the Swiss bank Sygnum offered institutional clients bank-held trading collateral, while ordinary customer balances stayed dependent on Bitget's own controls and its insurance fund. Bitget first disclosed the unauthorized transfers and halted withdrawals on September 24.