In a recent statement posted on the social media platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive security incident that resulted in the loss of roughly $352 million from the exchange’s holdings. Contrary to earlier speculation that the breach might have involved the theft of private cryptographic keys—a scenario that would imply a direct compromise of the underlying blockchain security—the investigation revealed that the attackers exploited a different vulnerability. Specifically, the perpetrators gained unauthorized access to the internal wallet management system used by Bitget and then proceeded to manipulate the transaction records that the system generated. By spoofing or falsifying these transaction data entries, the hackers were able to create the appearance of legitimate withdrawals, which were subsequently processed and transferred out of the exchange’s custodial accounts.
The distinction between a private‑key compromise and a spoofed‑transaction attack is significant for several reasons. Private keys are the fundamental secret codes that grant absolute control over cryptocurrency assets on the blockchain.
If a malicious actor obtains a private key, they can move funds directly on the ledger without any further interaction with the exchange’s internal infrastructure. In contrast, a spoofed‑transaction attack targets the exchange’s own internal processes—its wallet backend, which is responsible for aggregating user balances, generating withdrawal requests, and communicating with the blockchain. By tampering with this layer, the attackers effectively tricked the system into believing that a legitimate user had initiated a withdrawal, thereby authorizing the movement of funds that were, in reality, being siphoned off by the fraudsters.
According to Chen’s post, the breach began when the attackers managed to infiltrate the wallet backend—a critical component that handles the creation, signing, and broadcasting of transactions on behalf of Bitget’s customers. Once inside, they did not need to extract the private keys that secure the exchange’s cold storage wallets.
Instead, they altered the transaction metadata, such as the destination address and the amount, to reflect their own accounts. This manipulation allowed the forged transactions to pass through the exchange’s internal validation checks and be executed on the blockchain as if they were genuine user‑initiated withdrawals. The total financial impact of the incident was reported to be $351.6 million, a figure that underscores the scale of the operation.
While the exact method of entry into the wallet backend has not been fully disclosed, Chen emphasized that the breach did not involve a direct compromise of the cryptographic keys that protect the underlying assets. This nuance is crucial for users and regulators alike, as it points to a vulnerability in the exchange’s operational security rather than a flaw in the blockchain technology itself.
In response to the incident, Bitget has taken several remedial steps. The exchange has initiated a thorough forensic investigation in partnership with external cybersecurity firms to trace the attack vectors used and to identify any lingering weaknesses in its systems.
Additionally, Bitget has temporarily suspended certain withdrawal functions while it reinforces its internal controls and enhances monitoring mechanisms to detect anomalous transaction patterns more effectively. The company has also pledged to increase transparency with its user base, providing regular updates on the progress of the investigation and the measures being implemented to prevent future occurrences. The broader cryptocurrency community has taken note of Chen’s clarification, recognizing that attacks on exchange infrastructure—especially those that involve spoofed transaction data—are an emerging threat vector.
Unlike traditional hacks that target private keys, these types of breaches exploit the trust placed in an exchange’s internal processes and can be harder to detect because they may appear as legitimate activity on the blockchain. As a result, industry experts are calling for more robust audit trails, multi‑layer authentication, and real‑time anomaly detection systems that can flag irregularities before they result in irreversible loss of funds. For users of Bitget and other digital asset platforms, the incident serves as a reminder of the importance of diversifying storage strategies. While custodial services offer convenience, they also concentrate risk within a single point of failure.
Holding assets in personal wallets—especially hardware wallets that keep private keys offline—can mitigate exposure to exchange‑level vulnerabilities. However, such an approach also places the responsibility for security squarely on the individual, requiring diligent key management and backup practices.
Regulatory bodies are also likely to scrutinize the incident closely. In many jurisdictions, exchanges are mandated to implement stringent security protocols, conduct regular penetration testing, and maintain sufficient insurance coverage to protect user funds.
The fact that Bitget’s loss stemmed from a spoofed‑transaction attack may prompt regulators to update guidelines, emphasizing not only cryptographic safeguards but also the integrity of internal transaction processing systems. In summary, Bitget’s $352 million loss was not the result of a direct theft of private keys but rather a sophisticated manipulation of transaction data within the exchange’s wallet backend.
CEO Gracy Chen’s explanation sheds light on the technical nature of the breach, highlighting the need for stronger operational security measures across the cryptocurrency industry. As investigations continue and Bitget works to restore confidence among its users, the incident stands as a cautionary tale about the evolving tactics employed by cybercriminals and the critical importance of comprehensive security frameworks that protect both the cryptographic and procedural layers of digital asset management.