In a recent statement posted on the social media platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive security incident that resulted in the loss of approximately $352 million from the exchange’s holdings. Contrary to early speculation that the breach might have involved the theft of private cryptographic keys—a scenario that would suggest a direct compromise of the underlying blockchain assets—Chen emphasized that the attackers employed a more sophisticated method involving the manipulation of transaction data within the platform’s internal wallet infrastructure.
According to the CEO, the perpetrators succeeded in gaining unauthorized access to the backend systems that manage Bitget’s custodial wallets. Rather than extracting the private keys that control the movement of funds on the blockchain, the hackers instead injected falsified transaction records into the system. By spoofing these transfers, they were able to create the appearance of legitimate outgoing payments, prompting the exchange’s internal processes to approve and execute the fraudulent movements of cryptocurrency.
The distinction between stealing private keys and spoofing transaction data is significant for several reasons. Private keys are the fundamental cryptographic secrets that grant absolute control over a blockchain address; if they are compromised, the attacker can move funds directly on the public ledger without needing any further interaction with the exchange’s internal controls.
In contrast, spoofed transaction data exploits the trust that the exchange places in its own internal accounting and verification mechanisms. By feeding the system false information, the attackers effectively bypassed the safeguards that would normally detect irregularities in outbound transfers.
Chen’s explanation sheds light on the broader security challenges facing centralized cryptocurrency platforms. While many users focus on the safety of their private keys, the incident underscores that the security of the surrounding infrastructure—such as APIs, database servers, and transaction processing modules—can be equally, if not more, vulnerable. In Bitget’s case, the breach appears to have originated from a compromised component of the wallet backend, which likely involved elevated privileges or insufficient segmentation between different system layers. The CEO also highlighted the steps the company is taking in response to the incident.
Bitget has launched a comprehensive forensic investigation in collaboration with leading cybersecurity firms and law enforcement agencies. The investigation aims to trace the exact pathway the attackers used to infiltrate the system, identify any potential insider involvement, and recover the stolen assets where possible. Additionally, Bitget is reviewing and tightening its internal controls, including enhancing multi‑factor authentication for privileged accounts, implementing stricter monitoring of transaction anomalies, and conducting regular penetration testing to uncover hidden weaknesses. For users of Bitget and the broader crypto community, the incident serves as a cautionary tale about the importance of diversified risk management.
While custodial services offer convenience, they also concentrate risk within a single point of failure. Users who retain control over their own private keys through non‑custodial wallets can mitigate exposure to such backend attacks, though they must also manage the responsibility of safeguarding their keys.
The financial impact of the breach is substantial. The $351.6 million loss represents one of the largest single‑event thefts in the cryptocurrency sector to date, rivaling other high‑profile hacks such as those that targeted Mt.
Gox, Coincheck, and more recently, the Ronin network. Bitget has pledged to compensate affected users to the extent possible, though the exact mechanism for restitution remains under discussion and will depend on the outcomes of the ongoing investigation and any potential asset recovery efforts. In the aftermath, regulatory bodies are likely to scrutinize Bitget’s security practices more closely. The incident may prompt calls for stricter compliance standards for crypto exchanges, particularly regarding the segregation of duties, real‑time transaction monitoring, and the implementation of robust incident response frameworks.
As the industry continues to evolve, the balance between innovation and security remains a critical focal point for both operators and regulators. Overall, Gracy Chen’s clarification provides a clearer picture of how the $352 million breach unfolded: it was not a simple theft of private keys but a calculated exploitation of the exchange’s internal transaction processing system. By forging transaction data, the attackers managed to deceive Bitget’s own safeguards and siphon off a staggering amount of digital assets. The episode highlights the need for continuous improvement in security architecture, heightened vigilance against sophisticated cyber‑attacks, and a more informed approach by users when choosing between custodial and non‑custodial solutions in the crypto ecosystem.