In a recent statement posted on the social media platform X, Gracy Chen, the chief executive officer of the cryptocurrency exchange Bitget, clarified the nature of the massive security breach that resulted in the loss of roughly $352 million. Contrary to early speculation that the attackers might have obtained private keys—an often‑cited vulnerability in the crypto world—Chen emphasized that the perpetrators actually exploited a different weakness: they managed to spoof, or falsify, transaction data within the exchange’s wallet backend system. According to Chen’s explanation, the criminals did not directly steal private keys that control the movement of funds on the blockchain. Instead, they gained unauthorized access to the internal infrastructure that processes and records wallet transactions.
By manipulating the data that the system uses to verify and execute transfers, the attackers were able to create the illusion of legitimate withdrawals. The forged transaction records convinced the platform’s internal controls that the funds had been moved out of the exchange’s custodial wallets, allowing the thieves to siphon off the assets without triggering the usual alarms that would accompany a private‑key compromise. The breach resulted in a staggering financial loss of $351.6 million, a figure that places this incident among the most costly cryptocurrency hacks in recent history.
The sum was taken from a pool of user funds that Bitget holds in its custodial wallets, which are typically secured by a combination of multi‑signature protocols, cold storage solutions, and rigorous access controls. However, the attack demonstrated that even when private keys are well‑protected, vulnerabilities in ancillary systems—such as the software that handles transaction metadata—can become an entry point for malicious actors. Chen’s post on X outlined several key points about how the attack unfolded. First, the perpetrators infiltrated the backend environment that supports the exchange’s wallet services.
This could have involved phishing attempts aimed at employees, exploitation of unpatched software, or the use of stolen credentials to gain privileged access. Once inside, the attackers focused on the transaction processing layer, which is responsible for generating the data that tells the blockchain which addresses to debit and credit. By spoofing this data, the hackers were able to fabricate withdrawal requests that appeared authentic to the system’s internal checks.
The forged requests were then passed on to the blockchain, where the actual movement of cryptocurrency took place. Because the transaction data looked legitimate, the exchange’s monitoring tools did not flag the activity as suspicious, allowing the funds to be transferred out of Bitget’s custodial wallets and into addresses controlled by the attackers. The CEO’s clarification also highlighted an important lesson for the broader crypto industry: security cannot rely solely on protecting private keys. While safeguarding cryptographic keys remains a cornerstone of blockchain security, exchanges and other custodial services must also invest heavily in securing the surrounding infrastructure—especially the components that handle transaction creation, validation, and logging.
Robust auditing, anomaly detection, and multi‑factor authentication for internal systems are essential safeguards that can help detect and prevent the type of data‑level manipulation that occurred in this case. In response to the breach, Bitget has reportedly taken several immediate remedial actions.
The exchange has initiated a thorough forensic investigation in collaboration with cybersecurity experts and law‑enforcement agencies to trace the flow of the stolen funds and identify the exact method used to compromise the backend. Additionally, Bitget is enhancing its internal security protocols, including stricter access controls for privileged accounts, increased monitoring of transaction metadata, and the implementation of additional verification steps for large withdrawals.
The incident also raises broader regulatory considerations. As cryptocurrency exchanges continue to grow in size and influence, regulators worldwide are paying closer attention to the security standards these platforms must uphold.
Incidents like the Bitget hack underscore the need for clear regulatory frameworks that mandate comprehensive security audits, transparent reporting of breaches, and adequate consumer protection measures. For users of Bitget and other exchanges, the breach serves as a reminder to practice prudent personal security habits. While custodial services are responsible for safeguarding the bulk of user assets, individuals can mitigate risk by diversifying storage solutions—such as using hardware wallets for a portion of their holdings—and by staying informed about the security practices of the platforms they trust. In summary, Gracy Chen’s statement on X clarified that the $351.6 million loss suffered by Bitget was not the result of stolen private keys but rather the outcome of a sophisticated spoofing attack on the exchange’s transaction processing system.
The episode highlights the multifaceted nature of cybersecurity in the crypto sector, emphasizing that protecting cryptographic keys is necessary but not sufficient. Comprehensive security strategies must also address the integrity of the software and data pipelines that underpin every transaction. Bitget’s ongoing investigation and planned security upgrades aim to restore confidence among its users and set a higher standard for industry‑wide best practices.