Bitget CEO Gracy Chen confirmed that attackers breached a key backend system in the wallet infrastructure, forged transaction data, and triggered authorization processes to transfer funds out; private key leakage has been ruled out, and losses have been contained, with no further unauthorized transfers expected. The specific method of the breach is still under investigation, and a complete technical report will be published after verification.

The platform detected abnormal transfers from the hot wallet at 18:31 UTC, estimating an impact of approximately $351.6 million. The official statement claims that the cold wallet is intact, and the breach affected some hot and warm wallets within a three-tier architecture. The user protection fund has a balance exceeding $464 million, covering all losses. Deposits and trading continue, while all withdrawals are suspended, with no specific timeline for resumption promised.

On-chain data revealed the breach before the official statement. New addresses withdrew ETH, USDT, USDC, AVAX, BNB, and tokenized gold XAUT from wallets labeled with Bitget within about two hours, with early estimates ranging from $180 million to $192 million, later aligning with the official figure of $351.6 million. The attack address converted most of the stolen funds on EVM chains into approximately 67,982 ETH. Bubblemaps recorded 15 transactions across 7 asset types, with ETH accounting for about 44.4%. Some funds were exchanged for ETH at high prices through Uniswap and 1inch, with premiums reaching about 5%, to avoid freezing by stablecoin issuers.

Chen described the method in a live stream as similar to a supply chain attack: commonly used third-party tools compromised affected the wallet backend, forging transfer information and invoking the signing machine. She ruled out a high probability of forged user information or insider involvement, comparing it to the $1.5 billion theft from Bybit in February 2025, which also bypassed private keys and accessed signing authorization and multi-signature pages. The resumption of withdrawals will proceed alongside system fortification, potentially taking hours to days.

From a market mechanism perspective, what is sold is the liquidity of hot wallets, and what is bought are the potentially forged authorization work orders. The user protection fund fills the gap with its own reserves, effectively moving the assets stolen by hackers from the platform's balance sheet to the insurance pool. Beneficiaries are users who can continue trading without their account balances being altered, and the attack address that converted the stolen funds into ETH; the pressured parties are customers needing to withdraw funds and counterparties that must maintain market-making when withdrawals are closed. Funds flow from hot wallets to the attack address and then into decentralized liquidity pools, while the platform uses the protection fund to balance the ledger, and the on-chain assets do not automatically flow back.

Source: Public Information