Hackers Drain $351.6m From Bitget Hot Wallets, Exchange Says User Funds Are Covered

Cryptocurrency exchange Bitget has confirmed that hackers stole about $351.6 million after breaking into part of its wallet infrastructure.

The exchange said its systems flagged unauthorised transfers from several hot wallets at 18:31 UTC on Thursday, September 24, which triggered its emergency response protocols. In a security notice signed by CEO Gracy Chen, Bitget said only the hot and warm wallet layers were affected, while its cold wallets remained secure.

Withdrawals were temporarily suspended as a precaution, while deposits and trading continued. Bitget said the entire loss is covered by its User Protection Fund, which holds over $464 million. "User funds are safe," the exchange stated.

How the attack worked

In a follow-up update, Chen said the attackers compromised a critical backend system within the wallet infrastructure and used it to spoof transaction data, tricking the authorisation process into releasing funds. She said investigators had ruled out a private key compromise, and that the loss had been contained, with no further unauthorised transfers possible.

How the attackers first gained access to the backend system is still under investigation. Bitget said it will publish a full technical report once the findings are confirmed.

Assets and networks affected

The stolen assets included ETH, XRP, BNB, AVAX, USDT, USDC and other tokens, spread across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base networks. Chen said during a livestream that all on-chain cold wallets were confirmed secure.

North Korea link suspected

Chen said Bitget has contacted the foundations behind the affected blockchains, and some have already frozen wallet addresses tied to the attackers. She added that IP behaviour and on-chain analysis suggest the attack is "highly consistent" with known North Korean hacking groups. The exchange has reported the incident to the relevant institutions and is cooperating with a global investigation.

She also clarified that Bitget Wallet, the company's decentralised wallet product, runs independently of the exchange's infrastructure and was not affected.

Withdrawals still suspended

Technical teams are working on system remediation and security hardening, but Bitget has not given a date for restoring withdrawals. "We will not commit to timelines we cannot deliver on," Chen said.

Bitget has notified law enforcement agencies and on-chain security firms and says it is pursuing every available channel to recover the stolen assets. It had earlier promised hourly updates and a full incident report, including root-cause analysis and corrective actions, within 24 hours.