🚨 $351.6 million stolen! Bitget suffers major security incident
On September 24, Bitget detected unauthorized outgoing transfers from multiple hot wallets. The official confirmed that affected assets total approximately $351.6 million.
What’s even more noteworthy is:
🔴 Were the private keys stolen?
Bitget CEO Gracy Chen said the attackers did not obtain the private keys of the hot, warm, or cold wallets. Instead, they compromised the exchange’s critical internal backend system, and completed the transfer by forging transaction data to trigger the authorization process.
🔴 Is it possibly linked to North Korean hacker groups?
Gracy Chen stated that, based on the IP behavior characteristics currently observed and on-chain analysis, the attack method closely matches previously known activities of North Korean hacker organizations. Therefore, she believes it is “very likely” related to those groups. This attribution is still a judgment under investigation and is not a final judicial finding.
🔴 What happens to users’ assets?
Bitget said its user protection fund currently exceeds $464 million, which is higher than the affected amount of about $351.6 million. Trading and deposits remain operational, while withdrawals are temporarily paused for security review.
What the industry should truly reflect on after this incident is:
It may not be whether “the private keys were leaked,” but rather:
If attackers don’t need to obtain private keys, yet can still breach an exchange’s backend and trigger the authorization workflow—where exactly is the security boundary for centralized exchanges?
For ordinary users, what you should really focus on is👇
• The exchange’s wallet architecture
• Whether private keys and backend permissions are isolated
• Risk control and multi-signature mechanisms
• Whether the user protection fund is real, transparent, and coverable
• When withdrawals will resume after a major security incident
The $351.6 million incident once again reminds us:
🔐 Asset security ≠ only “private key security”
🏦 Exchange security ≠ only “cold wallet security”
🧠 Real security is a complete system—from permissions, systems, and processes to on-chain monitoring.
#Bitget遭黑客攻击损失3.52亿美元
$BTC

$ETH

$BNB