#Bitget Hot Wallet Breach: About $352 Million in Losses, No Private Keys Leaked; Protection Fund Covers the Damages
On September 24 at 18:31 UTC (Taiwan time 2:31 a.m. on the 25th), cryptocurrency exchange #Bitget detected unauthorized transfers from certain hot wallets and warm wallets. Preliminary estimates put the loss at approximately $351.6 million— the largest-scale hack of a centralized exchange this year to date.
CEO Gracy Chen said the attacker compromised key backend systems underlying the wallet infrastructure, falsified transaction data, and triggered the authorization process to move funds out. The company has ruled out any private key leakage. Cold wallets were not affected, and the losses were fully covered by the user protection fund with a scale of more than $464 million. The platform has suspended withdrawals, while deposits and trading remain normal.
The affected assets include ETH, XRP, USDT, USDC, AVAX, BNB, and others, spanning multiple blockchains. Bitget has flagged abnormal addresses and reported them to law enforcement and on-chain security organizations. It is working with Mandiant and SlowMist to investigate, and has pledged to restore withdrawals as soon as possible after completing security verification.
On September 24 at 18:31 UTC (Taiwan time 2:31 a.m. on the 25th), cryptocurrency exchange #Bitget detected unauthorized transfers from certain hot wallets and warm wallets. Preliminary estimates put the loss at approximately $351.6 million— the largest-scale hack of a centralized exchange this year to date.
CEO Gracy Chen said the attacker compromised key backend systems underlying the wallet infrastructure, falsified transaction data, and triggered the authorization process to move funds out. The company has ruled out any private key leakage. Cold wallets were not affected, and the losses were fully covered by the user protection fund with a scale of more than $464 million. The platform has suspended withdrawals, while deposits and trading remain normal.
The affected assets include ETH, XRP, USDT, USDC, AVAX, BNB, and others, spanning multiple blockchains. Bitget has flagged abnormal addresses and reported them to law enforcement and on-chain security organizations. It is working with Mandiant and SlowMist to investigate, and has pledged to restore withdrawals as soon as possible after completing security verification.
