Bitget CEO Gracy Chen locked losses at $351.6 million during a live stream, stating that the figure has not increased. All 19 hacker transfers came from hot and warm wallets, with cold wallets untouched. The root cause has not been pinpointed, but three paths have been ruled out: no forged user information for withdrawals, no acquisition of wallet private keys, and no withdrawals initiated after breaching the company's system.

The suspension of withdrawals is described as risk control rather than a lack of liquidity. Chen is concerned that resuming withdrawals before the investigation concludes could exacerbate losses, with a time frame of a few hours to a few days, clarifying that "it should not take weeks." Deposits and trading have previously been announced to remain open, with the resumption of withdrawals running parallel to system fortification, without making unfulfillable promises.

The asset structure differs from the $320 million theft at Bybit in February 2025: it involves more chains and tokens. The largest single token is XRP, exceeding $100 million; a large amount of USDT, USDT0, USDC, and tokenized gold XAU has been exchanged, totaling about $170 million in ETH. The attackers quickly converted stablecoins and gold tokens that could be frozen by issuers into Ethereum, continuing the on-chain practice of "Ethereum being the main chain for hacker withdrawals."

The official protection fund still reports over $464 million, covering the $351.6 million accounting gap. Early on-chain statistics only showed about $180 million to $192 million flowing out, with the discrepancy from including more chains and tokens in the final count. The qualitative aspect of the signature machine being called by forged work orders aligns with the first round of statements, merely reducing the "supply chain doubts" from speculation to "the system was used for withdrawals, and the private keys are still intact."

In market mechanics, what is sold is the hot wallet withdrawal channel, and what is bought is Ethereum, an asset without an issuer blacklist. The user protection fund fills the gap on the ledger, while on-chain XRP and stablecoins have already left the platform address. Beneficiaries are users whose account balances have not been altered and can still trade, as well as the attack addresses that converted stolen funds into ETH; the pressured parties are customers wanting to withdraw and market makers who must maintain inventory during the suspension. Funds moved from hot/warm wallets through 19 transfers into attack addresses, then surged into ETH from stablecoin and XAU pools, with the platform using insurance funds to balance liabilities.

Source: Public Information