Bitget Says Spoofed Transaction Data Enabled $351.6 Million Hack

Key Takeaways

• Bitget says an attacker used spoofed transaction data to trigger unauthorized transfers, affecting approximately $351.6 million in assets.
• The breach affected hot and warm wallets, as Bitget says cold wallets remained secure and its protection fund could cover the loss.
• Deposits and trading remain open, while withdrawals are suspended with no confirmed restart time.

Crypto exchange Bitget lost approximately $351.6 million on September 24 in a hack involving forged transaction data sent through its own authorization process, not stolen private keys, CEO Gracy Chen said.

“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. Private key compromise has been ruled out — this excludes the more severe risk scenarios. Loss containment is confirmed,” Chen wrote on X.

— Gracy Chen (@GracyBitget) Sep 25, 2026

The exchange also confirmed that withdrawals remained suspended during a security review.

The September 25 update identified a compromised wallet backend as the route used to move funds. Chen said the unauthorized outflows had been contained, while investigators were still determining how the attacker entered the system.

Wallet Backend Compromise

The breach surfaced when Bitget detected unauthorized transfers from some exchange hot wallets at 18:31 UTC on September 24. Hot wallets remain connected to the internet and hold funds used for day-to-day transfers, including withdrawals.

According to Chen, the attacker accessed a critical internal system and used it to create false transaction information. The data triggered Bitget’s approval process and caused unauthorized withdrawals.

Her account indicates that falsified transaction data passed through the exchange’s authorization process, although the initial intrusion method remains under investigation.

Bitget said the breach affected parts of its hot and warm wallet infrastructure, while its cold wallets remained secure.

“Bitget Wallet is a self-custodial wallet that operates on infrastructure completely separate and independent from Bitget Exchange, and it has not been affected by this incident,” Chen wrote on X.

The crypto exchange also said that it would release a technical report once the findings were confirmed.

Withdrawals Paused, Trading Continues

Withdrawals remain suspended on Bitget as a precaution during a security review. Deposits and trading continued, and the exchange said customer account balances remained accurate.

“During our additional security review, withdrawals are temporarily suspended; once we confirm it’s safe to resume, we will restore withdrawals as soon as possible,” said Chen.

Bitget said it would announce a withdrawal-reopening timetable when it could confirm one. The exchange also said that it had identified and flagged addresses linked to the transfers and engaged law enforcement and blockchain security firms.

Chen also listed the affected assets and networks.

“Affected assets include ETH, XRP (single-chain loss is the largest), BNB, AVAX, USDT, USDC, and other tokens. Involved chains include: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base,” said Chen.

Bitget Says Protection Fund Covers Loss

Bitget said its protection fund held 5,500 BTC, valued at approximately $464 million at the time of its update, and would absorb the assessed loss.

“User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million,” said Chen.

However, this assurance does not mean that the stolen funds have been recovered.

Chen said the company understands that users want answers as quickly as possible. She also said the exchange would release the technical findings once confirmed.

Bitget has not announced when withdrawals will resume, while investigators continue examining how the attacker breached its wallet backend.

Get started on WEEX with a simple 40 USDT reward. Deposit 100 USDT, make your trade, and claim the bonus. 

Disclaimer: All content on The Moon Show is for informational and educational purposes only. The opinions expressed do not constitute financial advice or recommendations to buy, sell, or trade cryptocurrencies. Trading involves significant risk and may result in substantial losses. Always seek independent financial advice before making investment decisions. The Moon Show is not responsible for any financial losses or decisions made based on the information provided.

Please view the full disclaimer at: https://themoonshow.com/disclaimer