In a recent statement posted on the social media platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive security breach that resulted in the loss of roughly $352 million from the exchange’s holdings. Contrary to early speculation that the attackers might have obtained private keys to directly siphon funds, Chen emphasized that the perpetrators instead exploited a vulnerability in the wallet’s backend infrastructure, allowing them to fabricate or “spoof” transaction data.
This deceptive method enabled the hackers to move a staggering sum of $351.6 million out of Bitset’s custodial wallets without needing to compromise the cryptographic keys that normally protect such assets. The breach unfolded when the malicious actors gained unauthorized access to the internal wallet management system used by Bitget to process deposits, withdrawals, and internal transfers. By infiltrating this system, they were able to manipulate the transaction logs and create false entries that appeared legitimate to the platform’s monitoring tools.
These falsified records effectively instructed the wallet service to transfer large amounts of cryptocurrency to addresses controlled by the attackers. Because the underlying cryptographic signatures remained intact—no private keys were stolen—the transaction appeared authentic from a technical standpoint, making it difficult for standard security checks to flag the activity as fraudulent.
Chen’s explanation underscores a critical distinction in the world of digital asset security: while private key theft is a well‑known vector for theft, attacks that target the operational layer of a platform—such as the wallet backend, APIs, or transaction processing modules—can be equally devastating. In Bitget’s case, the attackers leveraged their knowledge of the platform’s internal protocols to construct transaction payloads that passed validation checks. By spoofing the data, they bypassed the safeguards that would normally detect anomalous behavior, such as sudden large withdrawals or transfers to unfamiliar addresses.
The CEO also highlighted that Bitget’s immediate response involved a thorough forensic investigation, collaboration with cybersecurity experts, and coordination with law‑enforcement agencies to trace the flow of the stolen assets. Although the exact method of initial infiltration remains under investigation, Chen suggested that the attackers may have employed social engineering tactics, compromised employee credentials, or exploited an unpatched software vulnerability to gain the foothold needed to manipulate the wallet system. Industry observers note that this incident serves as a stark reminder for cryptocurrency exchanges and custodians to adopt a defense‑in‑depth strategy.
Beyond safeguarding private keys through hardware security modules (HSMs) and multi‑signature schemes, firms must also ensure that their operational infrastructure—particularly the components that handle transaction creation and approval—is hardened against tampering. This includes implementing robust access controls, continuous monitoring of transaction patterns, anomaly detection powered by machine learning, and regular penetration testing of backend services. In the aftermath of the hack, Bitget has pledged to reinforce its security posture. Chen announced plans to introduce additional layers of verification for high‑value transfers, such as requiring multiple independent approvals and integrating real‑time risk scoring engines.
The exchange also intends to conduct a comprehensive audit of its wallet architecture, engage third‑party security auditors, and adopt stricter employee training programs to mitigate the risk of credential compromise. For users of Bitget and the broader crypto community, the incident raises important questions about risk management and the transparency of exchange operations.
While the exchange has assured its customers that their personal funds remain secure and that the compromised assets belong to the platform’s own treasury, many users are calling for clearer disclosures about how custodial assets are protected and what contingency measures are in place in the event of a breach. The $351.6 million loss represents one of the largest single‑event thefts in the cryptocurrency sector to date, rivaling other high‑profile incidents such as the $600 million hack of the Ronin network and the $530 million breach at the crypto lending platform Celsius.
Each of these events highlights a common theme: sophisticated adversaries are increasingly targeting the operational layers of financial infrastructure, where they can manipulate data flows and exploit human or technical weaknesses. In conclusion, Gracy Chen’s clarification that Bitget’s hack was carried out via spoofed transaction data rather than stolen private keys underscores the evolving threat landscape facing digital asset platforms.
It reinforces the need for comprehensive security frameworks that protect not only the cryptographic keys but also the entire transaction processing pipeline. As the industry continues to mature, stakeholders—exchanges, regulators, and users alike—must prioritize robust security architectures, transparent incident reporting, and proactive risk mitigation to safeguard the growing volume of value stored on blockchain‑based platforms.