Crypto exchange Bitget reported losses of approximately $351.6 million following an attack on its wallet infrastructure. The exchange temporarily suspended withdrawals pending a security review while keeping deposits and trading available.
Bitget CEO Gracy Chen said the attack affected parts of its hot and warm wallet infrastructure. Chen said cold wallets remained secure and user balances were protected.
How did Bitget detect the attack?
According to the company, its security systems detected unauthorized transfers from some hot wallets at 18:31 UTC on Thursday, September 24. The security team then activated emergency response procedures.
Independent researchers had flagged unusual on-chain activity before the exchange issued its statement. Initial findings pointed to roughly $183 million in asset movements, while the company’s announcement put the incident’s scale at $351.6 million.
That created a significant gap between early reports and the loss disclosed by the company. The transactions researchers initially tracked represented only part of the total damage subsequently reported.
Attackers manipulated transaction data
According to preliminary findings Chen shared on September 25, attackers compromised a critical backend system within the wallet infrastructure. They then manipulated transaction data, causing the exchange’s own authorization process to approve outgoing fund transfers.
Chen said investigators had ruled out private key compromise. Her explanation indicates that the investigation is focusing on the mechanisms used to prepare and authorize wallet transactions.
The exchange also said it had stopped unauthorized outflows. However, investigators are still examining how the attackers accessed the system; the company plans to publish a comprehensive technical report once its findings are confirmed.
Will the protection fund cover the loss?
Chen said Bitget’s User Protection Fund held more than $464 million in assets. The company maintains that the fund covers the entire $351.6 million loss.
The exchange also said user account balances remained accurate and assets were protected. These assurances come from company management; withdrawals can resume only after the security review is complete.
The latest statements provide no specific date or time for withdrawals to reopen. Chen said technical teams were working to repair systems and strengthen security, adding that the exchange would not commit to a timeline it could not guarantee.
XRP accounts for the largest share of stolen assets
According to Lookonchain data, XRP accounts for the largest share of assets linked to the attack. The tracked assets include 102.93 million XRP worth approximately $157.5 million and 31,890 ETH valued at $85.8 million.
USDT, USDC and USDT0 together account for approximately $75.5 million. The list also includes gold-backed XAUt, BNB, AVAX and TRX.
The combined value of these assets was approximately $357 million at the time of measurement. Price fluctuations mean the on-chain calculation differs from Bitget’s reported loss of $351.6 million.
SlowMist findings cited in the same report show that addresses linked to the attack span multiple networks. The security firm reported that the attackers were converting some assets on EVM-compatible networks into ETH.
North Korea connection remains unconfirmed
Chen also said a North Korea-linked group could be behind the attack. According to comments reported by CryptoNews, that assessment rests on preliminary findings involving VPN connections and similarities to previous attacks.
However, investigators have yet to confirm which group carried out the attack. Chen’s assessment reflects the early findings of an ongoing investigation.
For users, the most immediate uncertainty is when withdrawals will reopen. Although deposits and trading remain available, transfers out of the platform must wait until security checks are complete.
