🔥 Bitget $350 Million Theft Case Revisited: Were the Private Keys Really Not Lost?
On September 24, Bitget’s hot wallet was stolen of approximately $350 million. But CEO Gracy Chen stated clearly: it was not a leak of private keys.
Attack path: Exploit a vulnerability in a third-party security product + steal internal network access credentials → forge withdrawal instructions sent to the wallet system → bypass risk controls → trigger an abnormal transfer.
In plain terms: they didn’t steal the vault key. Instead, they forged a “withdrawal slip” and took the money out from the bank’s own counter.
Three reminders for the industry:
1️⃣ The attack surface has changed: In the first half of 2026, nearly 90% of stolen funds were not recoverable. Attack targets are shifting from “code” to “people” and back-end systems.
2️⃣ Exchange balances ≠ your money: Large assets should still be self-custodied. Non-custodial wallets are the way to go.
3️⃣ This year, North Korean hackers accounted for 76% of the total global amount stolen in crypto. In front of state-level adversaries, any single point of trust is a target.
Bitget restored BTC withdrawals on September 28, and the user protection fund covers the losses. But next time—who will it be?
#Web3安全 #Bitget
On September 24, Bitget’s hot wallet was stolen of approximately $350 million. But CEO Gracy Chen stated clearly: it was not a leak of private keys.
Attack path: Exploit a vulnerability in a third-party security product + steal internal network access credentials → forge withdrawal instructions sent to the wallet system → bypass risk controls → trigger an abnormal transfer.
In plain terms: they didn’t steal the vault key. Instead, they forged a “withdrawal slip” and took the money out from the bank’s own counter.
Three reminders for the industry:
1️⃣ The attack surface has changed: In the first half of 2026, nearly 90% of stolen funds were not recoverable. Attack targets are shifting from “code” to “people” and back-end systems.
2️⃣ Exchange balances ≠ your money: Large assets should still be self-custodied. Non-custodial wallets are the way to go.
3️⃣ This year, North Korean hackers accounted for 76% of the total global amount stolen in crypto. In front of state-level adversaries, any single point of trust is a target.
Bitget restored BTC withdrawals on September 28, and the user protection fund covers the losses. But next time—who will it be?
#Web3安全 #Bitget