Bitget Says $351.6 Million Hack Used Spoofed Transfers, Not Stolen Keys

Bitget, one of the world’s ten largest crypto exchanges by trading volume, confirmed that attackers siphoned $351.6 million from its hot and warm wallets after compromising a backend system and spoofing transaction data to trigger the platform’s own authorization process. Crucially, CEO Gracy Chen said private keys were never stolen — a distinction that separates this breach from some of the industry’s most catastrophic hacks and shapes how quickly Bitget can plausibly recover.

The breach was detected at 18:31 UTC on September 24, 2026. Bitget said it moved immediately to halt further unauthorized transfers and froze withdrawals as a precaution while it investigated. The exchange also said its User Protection Fund, which holds more than $464 million, would cover the full amount lost, meaning affected users are not expected to be left absorbing the loss themselves.

How the Attack Worked

Bitget’s explanation centers on its tiered wallet architecture, a common industry safeguard: hot wallets hold funds for instant liquidity, warm wallets act as a buffer between hot and cold storage, and cold wallets remain offline and disconnected from the internet for maximum security. In this case, the company said its cold wallets were untouched. The attackers instead exploited a backend system tied to wallet infrastructure, feeding it spoofed transaction data that fooled the exchange’s own authorization mechanism into approving transfers out of the hot and warm tiers.

This matters because it changes the nature of the risk. A private-key compromise implies an attacker holds cryptographic control over funds indefinitely, and historically such breaches have produced some of the largest and most damaging losses in crypto’s history, since keys can’t simply be reissued the way a password can. A spoofed-authorization attack, by contrast, exploits a process flaw rather than the cryptographic root of custody. It is still a serious security failure — $351.6 million is a substantial sum, and the incident is being described as one of the costliest exchange hacks of the year — but it is, in principle, containable once the backend flaw is identified and patched, without requiring a wholesale migration of user funds to new wallets and keys.

What It Means for Bitget and Its Users

Bitget serves more than 125 million exchange users and also operates a separate self-custodial Bitget Wallet product used by over 100 million people, alongside roughly 1,900 employees as of 2025. The exchange has expanded beyond spot and derivatives trading into tokenized stocks, commodities, foreign exchange and precious metals — positioning itself as a broad multi-asset platform rather than a pure crypto venue. A breach of this scale tests not just Bitget’s technical defenses but the credibility of that broader ambition, since institutional and retail users alike weigh custodial security heavily when choosing where to hold diversified portfolios.

The response so far — freezing withdrawals, halting further transfers, and pledging full reimbursement through the protection fund — follows a now-familiar playbook among major exchanges that maintain insurance-style reserves precisely for scenarios like this. Whether the fund’s $464 million balance and Bitget’s public commitment translate into full, timely reimbursement for every affected user will be the real measure of whether this mechanism works as designed. Freezing withdrawals broadly also has costs: even users unaffected by the breach lose access to their funds temporarily, a trade-off exchanges routinely accept to contain damage during an active investigation.

What Comes Next

Several concrete developments are worth tracking in the coming weeks:

• Whether Bitget publishes a full technical post-mortem detailing exactly how the backend system was compromised and what fix has been deployed.
• The timeline for lifting the withdrawal freeze and whether reimbursements from the User Protection Fund are distributed on a set schedule.
• Any regulatory response given Bitget’s Seychelles registration and its global operating footprint, including whether other jurisdictions where it operates request disclosures.
• Whether other exchanges review or harden their own backend authorization systems in response, since the attack method — exploiting process logic rather than cryptography — could in theory be replicated elsewhere.

The episode arrives amid a broader push by traditional finance and crypto infrastructure providers to bring more real-world assets onchain, from tokenized deposits at major banks to tokenized equities on established exchanges. That parallel trend, covered in reporting on NYSE’s tokenized stock partnership with Blockchain.com and the SEC’s new exemption framework for tokenized US stocks, underscores how much institutional trust now rests on the custodial infrastructure underpinning these platforms. A breach at a top-ten exchange, even one contained without key theft, is a reminder that backend security remains as consequential as the assets being traded, a point echoed in coverage of banks coordinating on tokenized deposit systems that likewise depend on airtight transaction authorization.

Source: CoinDesk

This content is for informational purposes only and does not constitute financial or investment advice.