In a recent statement posted on the social media platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive security incident that saw the cryptocurrency exchange lose roughly $352 million. Contrary to the common assumption that the attackers had somehow obtained the private keys that control users’ funds, Chen emphasized that the breach was executed through a more sophisticated method: the spoofing of transaction data within the exchange’s wallet infrastructure. The incident unfolded when malicious actors gained unauthorized access to a component of Bitget’s wallet backend system.
Rather than extracting the cryptographic keys that would normally be required to move assets directly from the blockchain, the perpetrators manipulated the internal transaction records that the exchange uses to reconcile deposits, withdrawals, and internal transfers. By falsifying these records, they were able to create the appearance of legitimate outgoing transactions, prompting the system to release funds to addresses under the attackers’ control.
This approach exploits a critical vulnerability in the way many centralized exchanges handle transaction processing. While the blockchain itself remains immutable and secure, the off‑chain systems that manage order books, user balances, and withdrawal requests are often complex and involve multiple layers of software. If an adversary can compromise any of these layers—particularly the services that generate or validate transaction metadata—they can effectively “trick” the exchange into authorizing transfers that were never legitimately requested by a user. According to Chen, the attackers specifically targeted the API endpoints responsible for signing withdrawal requests.
By injecting forged data into these endpoints, they caused the exchange’s signing module to produce valid signatures for transactions that the exchange’s internal accounting system believed were authentic. The signatures, once placed on the blockchain, resulted in the transfer of large sums of cryptocurrency to wallets controlled by the perpetrators.
Because the blockchain validates the signatures rather than the intent behind them, the transfers were processed without any immediate red flag. The scale of the loss—$351.6 million—places this breach among the most severe in the history of digital asset platforms. It underscores a growing trend where threat actors focus on the “soft” side of security, targeting operational processes, internal communications, and software supply chains rather than attempting to break the cryptographic primitives themselves. In many cases, these softer attacks are easier to execute and can yield far greater financial rewards.
In response to the breach, Bitget has taken several immediate remedial actions. The exchange temporarily halted all withdrawals to prevent further unauthorized outflows while it conducts a comprehensive forensic investigation. Chen indicated that the company is working with external cybersecurity firms and law enforcement agencies to trace the stolen funds, which, due to the pseudonymous nature of blockchain transactions, may involve following a complex trail through multiple mixers and exchange platforms.
Furthermore, Bitget plans to implement a series of technical upgrades aimed at hardening its wallet infrastructure. These upgrades include the introduction of multi‑signature controls for high‑value withdrawals, stricter segregation of duties within the transaction processing pipeline, and enhanced monitoring tools that can detect anomalies in transaction patterns in real time. The exchange is also reviewing its internal access controls to ensure that only a minimal set of trusted personnel have the ability to modify critical backend components. The incident has sparked a broader conversation within the cryptocurrency community about the importance of robust operational security measures.
While users often focus on the safety of their private keys and the security of the blockchain itself, the reality is that centralized services act as custodians for a massive amount of digital wealth. As such, the security of their internal systems is just as crucial. Industry experts recommend that exchanges adopt a defense‑in‑depth strategy, combining cryptographic safeguards with rigorous software development lifecycle practices, regular penetration testing, and continuous security awareness training for staff.
For users of Bitget and similar platforms, the breach serves as a reminder to consider the risks associated with leaving large balances on centralized exchanges. Diversifying holdings across multiple wallets, using hardware wallets for long‑term storage, and staying informed about the security posture of service providers can help mitigate potential losses.
In summary, the $352 million hack at Bitget was not the result of stolen private keys but rather a sophisticated manipulation of transaction data within the exchange’s wallet backend. By spoofing transaction records, the attackers were able to generate legitimate‑looking blockchain signatures that authorized the illicit transfer of funds.
Bitget’s leadership, led by CEO Gracy Chen, has publicly acknowledged the breach, outlined immediate containment steps, and pledged to strengthen the platform’s security architecture to prevent future occurrences. The episode highlights the evolving threat landscape in the crypto industry, where attackers increasingly target the operational layers of platforms, reinforcing the need for comprehensive security practices that go beyond traditional cryptographic safeguards.