Bitget $351.6M Hack Probe Points to Backend Breach as Private-Key Leak Is Ruled Out
Bitget's preliminary review into a $351.6 million hack points to a backend wallet architecture breach rather than a private-key leak, with CEO Gracy Chen noting potential ties to North Korean VPN behavioral patterns.
An initial review into the September 24 hack at Bitget centers on its backend wallet architecture. The platform confirmed that no private keys were compromised during the incident, which saw an estimated $351.6 million stolen. Despite the breach, trading and deposits continued as usual, while withdrawals were temporarily halted.
Bitget noted that the illicit withdrawals were flagged at 18:31 UTC, prompting emergency protocols within minutes. While the exploit targeted certain hot and warm wallets on the platform, its cold storage remained entirely secure.
According to Bitget, user balances remain accurate, with the losses fully covered by the User Protection Fund, which holds a balance exceeding $464 million. The situation has also drawn the attention of blockchain security firms and law enforcement.
The exchange reported that the suspicious destination addresses have been successfully flagged and shared. Withdrawals lack a set restart schedule and will only resume following a comprehensive security audit.
During a live Q&A session, Bitget CEO Gracy Chen confirmed that the team has ruled out any private key leakage within the wallet infrastructure, explaining instead that perpetrators gained entry to the exchange systems to move funds outward.
Preliminary findings indicate that the primary backend wallet service was compromised, with fraudulent transactions reaching the approval-signature phase. However, Bitget is holding off on sharing deeper technical specifics until the investigation concludes.
Read More: $320M Bitcoin Hack: What Really Happened to Liquid Network?
On-chain tracking by Lookonchain places the stolen portfolio value slightly higher at $356.8 million based on pricing at the time, with the largest holdings consisting of 102.93 million XRP (roughly $157.48 million) and 31,890 ETH (roughly $85.75 million).
Additional affected assets included USDT, USDC, USD₮0, XAUt, BNB, AVAX, and TRX. These discrepancies stem from varying valuation methods rather than any adjustment to Bitget’s loss metrics.
Definitive links to North Korean hackers remain unconfirmed. Chen noted that investigators discovered IP addresses utilizing popular VPN services consistent with those used by North Korean hacking syndicates, pointing to a matching behavioral pattern.
Neither Bitget nor any government body officially attributed the breach directly to North Korea during the immediate aftermath of the attack.
While engineering teams work on repairing damaged systems and upgrading safety protocols, withdrawals are still frozen without a confirmed timeline for reopening, though deposits and trading functions remain operational.
Read More: FBI Crypto Crime Forum Targets Scams, Hacks and North Korean Threats
Chen mentioned that a portion of the stolen funds has been successfully recovered, though no specific monetary figures were provided or independently verified by reporters.
Bitget has committed to releasing a comprehensive incident report detailing the root cause and mitigation steps within 24 hours of its initial September 24 alert. Until that technical report is published, the backend breach and potential North Korean connection should be viewed as preliminary conclusions.
Frequently Asked Questions
Were private keys exposed during the Bitget hack?
No. Bitget’s preliminary investigation explicitly ruled out a private-key leak, pointing instead to a compromise within the backend wallet infrastructure.
How much was stolen in the breach?
Bitget estimates the total losses at approximately $351.6 million, while on-chain analysis firm Lookonchain values the stolen portfolio at roughly $356.8 million.
Are user funds safe?
Bitget stated that user balances are accurate and that the entirety of the loss is covered by its User Protection Fund, which holds more than $464 million.
Can users still trade and deposit funds?
Yes. Deposits and trading have remained functional, but withdrawals were suspended immediately following the incident and will only resume after a complete security review.
Web3 PR Specialist | KOL | Blockchain Advocate | Digital Strategy Expert based in Moscow, Russia. Focused on Web3 communications, blockchain, digital strategy, and community growth.
More from this author
Comments 0 responses