Crypto exchange Bitget lost $351.6 million in an overnight hack. CEO Gracy Chen said attackers faked transfer requests to drain funds but did not steal “private keys.”
“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” Chen wrote on X. “Private key compromise has been ruled out.”
That distinction matters and points to a less alarming attack vector. Private key hacks have driven some of the industry's biggest losses.
Every crypto wallet has two keys. The public key is like a bank account number and can be shared so someone can send funds in. The private key is the secret string that proves ownership and authorizes spending, closer to a password and a vault combination in one. If those private keys are copied, an attacker can keep signing new transfers and draining funds.
Chen said that is not what happened here.
She described the breach as the digital version of slipping forged withdrawal slips through a bank’s own teller window. The vault keys never left the building. Someone got into the office that prepares the slips, created paperwork that looked official, and sent it through the same approval window the bank uses every day. To the system doing the approving, it looked like a normal payout.
The outflow, however, has been stopped, Chen confirmed.
“Loss containment is confirmed. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation. A full technical report will follow once confirmed,” she said.
Bitget, officially registered and headquartered in Seychelles, is one of the top 10 cryptocurrency exchanges in the world by trading volume.
The exchange serves over $125 million users spread across the globe and facilitates trading in hundreds of crypto tokens, alongside tokenized stocks, commodities, FX and precious metals such as gold. Additionally, its self-custodial Bitget Wallet has independently crossed 100 million users.
As of 2025, the exchange had roughly 1,900 employees.
The breach surfaced when Bitget’s systems flagged unauthorized transfers from some exchange hot wallets at 18:31 UTC on Sept. 24. A hot wallet stays connected to the internet so funds can move quickly. For an exchange, it is a temporary liquidity hub, analogous to an online cash drawer that handles instant trades, deposits, and withdrawals.
Source
This article is syndicated for educational reading. For the latest updates, visit the original publisher.
Read on coindesk.com
