In a recent statement posted on the social platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive security incident that resulted in the loss of roughly $352 million from the exchange’s custodial wallets. Contrary to early speculation that the breach might have involved the theft of private cryptographic keys—a scenario that would imply a direct compromise of the underlying blockchain assets—Chen emphasized that the attackers leveraged a more sophisticated form of deception: they spoofed transaction data within the platform’s internal wallet management system. According to Chen, the perpetrators first gained unauthorized access to the backend infrastructure that handles wallet operations.
This backend is responsible for aggregating user deposits, managing internal ledgers, and coordinating the outward flow of funds to external addresses. By infiltrating this layer, the attackers were able to manipulate the information that the system uses to verify and execute withdrawals. Rather than stealing the private keys that control the actual blockchain addresses, the hackers fabricated false transaction records that made it appear as though legitimate withdrawals were being processed.
The spoofed data tricked Bitget’s internal controls into believing that the funds had already been moved to a safe destination, allowing the malicious actors to reroute the assets to addresses under their control. Because the deception occurred at the application level—before the transaction data reached the blockchain for final confirmation—the exchange’s on‑chain security measures were effectively bypassed. In other words, the blockchain itself did not record any unauthorized movement; the illicit transfer was orchestrated entirely within Bitget’s own systems.
Chen’s explanation underscores a critical distinction in the world of cryptocurrency security: protecting private keys is essential, but it is only one piece of a broader defensive puzzle. Even if an organization maintains airtight key management practices, vulnerabilities in the surrounding software stack—such as APIs, database interfaces, and internal transaction processing modules—can provide an alternate attack surface. In Bitget’s case, the breach exploited a weakness in the way transaction metadata was validated and transmitted between internal services.
The CEO also highlighted the scale of the financial impact. The exchange reported that the total amount siphoned off amounted to $351.6 million, a figure that reflects the aggregated value of the assets that were misdirected through the spoofed transfers.
This loss represents one of the largest single‑event crypto heists in recent history and has prompted a wave of scrutiny from regulators, industry peers, and the broader investing public. In response to the incident, Bitget has initiated a multi‑pronged remediation strategy.
First, the company is conducting a thorough forensic investigation with the assistance of external cybersecurity firms to map the exact pathway the attackers used and to identify any lingering backdoors. Second, the exchange is bolstering its internal controls by implementing stricter verification protocols for transaction data, including multi‑factor authentication for privileged backend access and real‑time anomaly detection powered by machine‑learning algorithms. Third, Bitget is working closely with law enforcement agencies across multiple jurisdictions to trace the flow of the stolen funds and to pursue legal action against the perpetrators. The incident also serves as a cautionary tale for other cryptocurrency platforms.
It illustrates how attackers can bypass traditional security measures by targeting the “human‑machine interface” of a system—where data is formatted, logged, and handed off between services. As the industry matures, there is a growing consensus that robust security must encompass not only cryptographic safeguards but also rigorous software engineering practices, continuous code audits, and comprehensive threat‑modeling exercises that account for insider threats and sophisticated external actors. For users of Bitget and similar exchanges, the breach raises important questions about asset custody and risk management. While many platforms advertise custodial solutions for convenience, the reality is that entrusting large sums of crypto to a third‑party service inherently carries counterparty risk.
Investors are encouraged to diversify their storage strategies, consider hardware wallets for long‑term holdings, and stay informed about the security posture of any exchange they use. In summary, Gracy Chen’s clarification on X makes it clear that the $352 million loss at Bitget was not the result of private key compromise but rather a cunning manipulation of transaction data within the exchange’s own wallet backend. The attack exploited a gap in internal verification processes, allowing the thieves to masquerade as legitimate withdrawals and divert funds to their own addresses. Bitget’s ongoing investigation and remediation efforts aim to patch these vulnerabilities, enhance monitoring, and cooperate with authorities to recover the stolen assets.
The episode underscores the evolving nature of cyber threats in the crypto space and the necessity for comprehensive, layered security approaches that go beyond mere key protection.