Bitget confirms that approximately 351.6 million USD worth of digital assets were illegally transferred out of a portion of its hot and warm wallet system in a security incident that occurred on September 24. The exchange said cold wallets were not affected and customers’ balances remained intact.
Notably, the incident did not originate from the leakage of private keys. According to preliminary investigation, the attacker gained access to the backend system related to wallet infrastructure and created fraudulent transaction data, which then went through the system’s approval process. Bitget is still investigating exactly how the attacker accessed the system.
XRP makes up the majority of the stolen assets
On-chain data from Lookonchain indicates that XRP is the largest asset in the category that was withdrawn, with about 102.93 million XRP valued at 157.48 million USD. In addition, there were approximately 31,890 ETH, 34.75 million USDT, 21.06 million USDC, 19.67 million USDT0, 3,000 XAUt, 12,719 BNB, 821,012 AVAX, and over 20.59 million TRX. The total value based on Lookonchain’s valuation is about 356.9 million USD, higher than Bitget’s disclosed figure of 351.6 million USD due to different calculation methods and valuation timing.
Bitget has temporarily suspended all withdrawals to support the investigation, while deposits and trading operations remain active. The exchange also said that the User Protection Fund currently has over 464 million USD, enough to cover the entire estimated loss of 351.6 million USD.
Notably, the incident did not originate from the leakage of private keys. According to preliminary investigation, the attacker gained access to the backend system related to wallet infrastructure and created fraudulent transaction data, which then went through the system’s approval process. Bitget is still investigating exactly how the attacker accessed the system.
XRP makes up the majority of the stolen assets
On-chain data from Lookonchain indicates that XRP is the largest asset in the category that was withdrawn, with about 102.93 million XRP valued at 157.48 million USD. In addition, there were approximately 31,890 ETH, 34.75 million USDT, 21.06 million USDC, 19.67 million USDT0, 3,000 XAUt, 12,719 BNB, 821,012 AVAX, and over 20.59 million TRX. The total value based on Lookonchain’s valuation is about 356.9 million USD, higher than Bitget’s disclosed figure of 351.6 million USD due to different calculation methods and valuation timing.
Bitget has temporarily suspended all withdrawals to support the investigation, while deposits and trading operations remain active. The exchange also said that the User Protection Fund currently has over 464 million USD, enough to cover the entire estimated loss of 351.6 million USD.