Meta News

Cryptocurrency exchange Bitget has disclosed a major security breach in which attackers stole approximately $351.6 million in digital assets from several of its hot and warm wallets.

The company detected the intrusion after its security systems identified multiple unauthorized transfers from a limited number of wallets. Bitget has temporarily suspended withdrawals while it investigates the attack with law enforcement, blockchain security specialists, Mandiant, and SlowMist.

Bitget says customer balances remain accurate and that its cold wallets, which hold the majority of its assets, were not affected.

The most important detail is that the attackers apparently did not simply steal a private key.

According to Bitget CEO Gracy Chen, the hackers compromised a critical backend system within the exchange’s wallet infrastructure. They then manipulated transaction information in a way that triggered Bitget’s legitimate authorization and signing process.

In other words, the attackers appear to have abused the infrastructure responsible for deciding which transactions should be signed rather than directly defeating the underlying cryptography.

Bitget says the specific method used to compromise the backend system remains under investigation.

The incident affected assets across multiple blockchains, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain, and Base. Stolen assets included ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens.

The largest loss on a single blockchain involved XRP.

Bitget says preliminary evidence indicates the operation was likely conducted by North Korean hackers.

The company based that assessment on IP behavior and blockchain analysis, saying the techniques were highly consistent with previously documented North Korean cryptocurrency operations. The attribution remains part of an ongoing investigation.

North Korean hacking groups have repeatedly targeted cryptocurrency companies as a source of revenue.

One of the most significant previous incidents was the February 2025 breach of Bybit, where attackers stole approximately $1.5 billion in cryptocurrency after compromising infrastructure involved in the exchange’s transaction-signing process.

The Bitget incident shares an important characteristic with attacks of this type: compromising the systems surrounding a cryptocurrency wallet can be more effective than attempting to break the cryptography protecting the wallet itself.

Despite the size of the theft, Bitget says customers will not absorb the losses.

The exchange maintains a User Protection Fund containing roughly 5,500 BTC, valued at approximately $464 million at the time of the disclosure. That fund is large enough to cover the $351.6 million stolen in the attack.

Bitget says deposits and trading continue operating normally, while withdrawals remain temporarily suspended.

The company’s separate self-custodial Bitget Wallet was not affected, because it operates using infrastructure independent from the centralized Bitget Exchange.

Some blockchain networks have also reportedly frozen addresses associated with the attackers, potentially making it more difficult to move or launder portions of the stolen assets.

Cryptocurrency exchanges generally divide assets between different types of storage.

Cold wallets remain offline or heavily isolated and are designed to protect the majority of an exchange’s reserves. Hot wallets remain connected to operational systems so customers can deposit and withdraw cryptocurrency quickly. Warm wallets provide an intermediate approach.

That convenience creates additional exposure.

Attackers do not necessarily need direct access to the private keys if they can compromise the systems responsible for constructing, approving, or authorizing transactions.

This makes wallet-management infrastructure, signing policies, backend services, and privileged administrator access critical parts of an exchange’s security architecture.

Bitget says the unauthorized transfer mechanism has been disabled and that no additional malicious transactions can currently occur.

Withdrawals will remain suspended until investigators determine that normal operations can safely resume.

The company is also working with blockchain analytics firms, cybersecurity specialists, law enforcement agencies, and other exchanges to trace the stolen assets and block attacker-controlled addresses.

At $351.6 million, the incident ranks among the largest cryptocurrency exchange thefts in recent years.

But the technical details may ultimately prove more important than the dollar amount. The attackers appear to have compromised a trusted backend component and manipulated a legitimate transaction-signing workflow.

That reinforces a recurring lesson from major cryptocurrency breaches: the strongest cryptographic key is only as secure as the infrastructure deciding when that key should be used.