Gracy Chen, CEO of Bitget, confirmed that the attackers infiltrated key backend systems in the wallet infrastructure, forged transaction data, and triggered authorization processes to transfer funds out; private key leakage has been ruled out, losses have been contained, and unauthorized transfers will not occur again. The specific methods of the intrusion are still under investigation, and a complete technical report will be published after verification.

The platform detected abnormal transfers from the hot wallet at 18:31 UTC, estimating an impact of approximately $351.6 million. The official statement claims that the cold wallet is intact, and the breached parts are some hot and warm wallets within a three-layer architecture. The user protection fund has a balance exceeding $464 million, covering all losses. Deposits and trading continue, but all withdrawals are suspended, with no specific hours promised for resumption.

On-chain data exposed before the official statement. New addresses withdrew ETH, USDT, USDC, AVAX, BNB, and tokenized gold XAUT from wallets labeled with Bitget within about two hours, with early estimates ranging from $180 million to $192 million, later aligning with the official figure of $351.6 million. The attack address converted most of the stolen funds on EVM chains into approximately 67,982 ETH. Bubblemaps recorded 15 transactions across 7 asset types, with ETH accounting for about 44.4%. Some funds were exchanged for ETH at high prices through Uniswap and 1inch, with premiums reaching about 5%, to avoid freezing by stablecoin issuers.

In a live broadcast, Chen described the method as similar to a supply chain attack: commonly used third-party tools, once compromised, affected the wallet backend, forged transfer information, and called the signing machine. She ruled out a high probability of forged user information and internal personnel involvement, comparing it to the $1.5 billion theft from Bybit in February 2025, which similarly bypassed the private key and accessed through signing authorization and multi-signature pages. The resumption of withdrawals will proceed alongside system fortification, potentially taking hours to days.

From a market mechanism perspective, what is sold is the liquidity of hot wallets, and what is bought are the potentially forged authorization work orders. The user protection fund fills the gap with its own reserves, effectively transferring the assets taken by hackers from the platform's balance sheet to the insurance pool. Beneficiaries are users who can continue trading without their account balances being altered, as well as the attack address that converted the stolen funds into ETH; those under pressure are customers needing to withdraw funds and counterparties that must maintain market-making when withdrawals are closed. Funds flow from hot wallets to the attack address and then into decentralized liquidity pools, with the platform using the protection fund to balance the ledger, while the on-chain assets do not automatically flow back.

Source: Public Information