Bitget lost $351.6 million in an overnight attack — but CEO Gracy Chen says the hackers never touched private keys. Instead, they compromised a critical backend system in the exchange's wallet infrastructure, spoofed transaction data, and pushed the fake transfers through Bitget's own authorization process. Containment is confirmed, the loss is fully covered by a $464 million protection fund, and Binance's security team is among those assisting the fund-tracing effort.The Attack Forged Requests Rather Than Stealing KeysChen's distinction matters technically. A private key is the secret that proves ownership and authorizes spending — if copied, an attacker can keep signing new transfers indefinitely, which is why private key compromises have driven some of the industry's largest losses. Here, per Chen, the keys never left the building: attackers got into the system that prepares transfer requests, created paperwork that looked official, and sent it through the same approval window used every day. Once the forged-request pathway is closed, the bleeding stops — which is consistent with Chen's confirmation that no further unauthorized transfers are possible. The specific intrusion method remains under investigation, with a full technical report promised.Hot and Warm Wallets Were Hit; Cold Storage Was NotThe breach surfaced when Bitget's systems flagged unauthorized transfers from exchange hot wallets — the internet-connected liquidity layer handling instant trades and withdrawals — at 18:31 UTC on September 24. The attack also reached the warm-wallet layer, the semi-connected buffer that tops up hot wallets and sweeps excess deposits offline. Cold wallets, the fully offline vault holding the bulk of assets, remain secure per Chen. That containment pattern is why the loss, while large, stayed at $351.6 million rather than threatening the exchange's full reserves.A $464 Million Fund Covers the Loss but Withdrawals Stay FrozenBitget's User Protection Fund holds more than $464 million — roughly 132% of the loss (derived) — and Chen said user balances are accurate and assets protected. Deposits and trading remain open; withdrawals are frozen as a precaution pending security review, with no timeline given — Chen said the exchange will not commit to a window it cannot guarantee. Meanwhile, the industry response outlined by Binance CEO Richard Teng earlier — intelligence sharing, on-chain fund tracking and asset recovery support — is underway, with the speed of cross-exchange address flagging the key variable in whether the $351.6 million can be intercepted before attackers off-ramp.What to Watch as the Investigation UnfoldsThree open threads: the technical report identifying the intrusion method (which will show whether other exchanges share the vulnerable architecture), on-chain movement of the tagged funds, and the withdrawal resumption timeline — historically the moment that tests user confidence most. The incident also reinforces a 2026 pattern: back-office and infrastructure compromises are displacing private key theft as the attack surface that matters.