Bitget's $352 million hack happened via spoofed transfers, not private keys, CEO Gray Chen says

Bitget disclosed that attackers drained $351.6 million after gaining access to a critical backend system in its wallet infrastructure and using it to fabricate transaction data that passed the exchange’s authorization process. CEO Gracy Chen wrote on X that the operation mimicked legitimate transfer requests rather than obtaining or copying private keys, which the company says were not compromised. According to Bitget, the incident was detected when systems flagged unauthorized transfers from several hot wallets at 18:31 UTC on Sept. 24. The attackers’ activity extended into the warm-wallet layer, a semi-connected buffer used to top up hot wallets and move excess funds off the internet, but did not reach the exchange’s cold wallets, which Bitget says remain fully secure. Chen described the exploit as akin to forging withdrawal paperwork inside a bank and sending it through normal approval channels; from the authorizing systems’ perspective the transfers appeared legitimate. Bitget also reported that the outflow has been stopped and no further unauthorized transfers are possible while the method of intrusion is under active investigation. Bitget said its User Protection Fund, which holds more than $464 million, will cover the loss and that user account balances are accurate. The exchange has kept deposits and trading open but suspended withdrawals as a precaution pending a security review, with multiple technical teams working on remediation and security hardening. A detailed technical report will be published after confirmation of findings.