The Bitget breach is beginning to look less like a conventional cryptocurrency wallet hack and more like a compromise of the machinery responsible for deciding which transactions should be signed.
Bitget CEO Gracy Chen said Friday that attackers compromised a critical backend system inside the exchange’s wallet infrastructure, altered transaction data and triggered Bitget’s authorization process to approve unauthorized transfers.
The exchange estimates approximately $351.6 million in assets were affected. Bitget official security notice
Bitget says private keys were not stolen.
That distinction changes the technical picture considerably.
The Keys Apparently Stayed Secure
Private-key compromise is one of the most dangerous forms of exchange breach because whoever obtains the keys can independently authorize transactions until those credentials are replaced or the wallets are emptied.
Chen says that did not happen.
Instead, the attackers apparently compromised software upstream from the signing process.
According to her explanation reported by CoinDesk, attackers created fraudulent transfer instructions that appeared legitimate to Bitget’s authorization infrastructure. The system then processed those requests using its normal approval mechanisms. CoinDesk, Bitget says spoofed transfers caused $351.6 million breach
In practical terms, the vault key did not need to be stolen if the attacker could convince the vault operator to open the door.
That makes the authorization layer itself the security failure.
Hot and Warm Wallets Were Affected
Bitget’s official security notice says the breach was contained to portions of its hot and warm wallet layers.
Cold wallets remained secure.
Bitget describes its custody infrastructure as a three-tier architecture consisting of hot, warm and cold storage. Bitget
Hot wallets provide liquidity for routine withdrawals and exchange operations.
Warm wallets provide an intermediate security layer.
Cold wallets remain offline and are generally used to protect the majority of exchange reserves from internet-facing attacks.
The compromise of both hot and warm infrastructure explains why the incident reached hundreds of millions of dollars without reaching Bitget’s cold-storage reserves.
The Exchange Says the Outflow Has Stopped
Chen said further unauthorized transfers have been prevented.
Bitget suspended withdrawals after detecting the breach at 18:31 UTC on September 24. Deposits and conventional trading remained operational, although Bitget later said its Onchain trading service was temporarily unavailable during the broader security review. Bitget withdrawal suspension notice Bitget Onchain transaction delay notice
Withdrawal restoration remains one of the most important operational confirmation signals.
Until users can withdraw normally, the incident is not fully resolved from a customer perspective.
Circle and Tether Have Begun Freezing Assets
Stablecoin issuers have also entered the recovery effort.
Circle and Tether blacklisted an attacker-controlled wallet containing approximately $318,000 in USDT and USDC, according to CoinDesk. CoinDesk, Circle and Tether freeze Bitget hacker wallet
The frozen amount represents only a small portion of the overall loss.
Much of the stolen value is reportedly held in assets such as ether, which cannot be frozen by a centralized issuer.
The incident again demonstrates why stablecoins behave differently from decentralized native assets during hacks. Centralized issuers can blacklist addresses. Ethereum itself cannot freeze ETH at the request of an exchange.
Protection Fund Covers the Reported Loss
Bitget says its User Protection Fund contains more than $464 million, exceeding the currently reported $351.6 million loss.
The exchange says customer balances remain accurate and protected. Bitget
Financial coverage, however, is separate from technical containment.
A protection fund can replace lost assets.
It cannot explain why the authorization infrastructure accepted fraudulent transfer requests.
That explanation will matter when Bitget publishes its complete incident analysis.
The Attack Expands the Exchange Security Model
Cryptocurrency security discussions often focus on private keys.
The Bitget incident demonstrates that protecting keys alone is insufficient.
Modern exchanges operate complex systems around those keys, including withdrawal engines, transaction-generation software, policy controls, signing services, access-management systems and automated approval workflows.
An attacker who compromises the instructions entering the signing process may not need direct access to the signing key itself.
That creates another security perimeter exchanges need to defend.
TOKEN RECON ASSESSMENT
The most important development since yesterday is that the attack vector is becoming clearer.
Bitget’s private keys apparently survived.
Its authorization infrastructure did not.
That shifts attention from key custody toward backend transaction integrity.
Exchanges should assume attackers will target the systems that tell secure wallets what to sign, not merely the wallets themselves.
The next intelligence checkpoints are Bitget’s complete forensic report, withdrawal restoration, recovery of stolen assets, any additional stablecoin freezes and confirmation of how attackers first gained access to the backend system.
The protection fund gives Bitget financial room to absorb the loss.
The forensic report will determine whether the exchange has closed the vulnerability that caused it.
Sources
Bitget official security notice
Bitget withdrawal suspension notice
CoinDesk, Bitget says spoofed transfers caused the $351.6 million breach
