In a recent statement posted on the social media platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive financial breach that recently shook the cryptocurrency exchange. Contrary to the common assumption that such large‑scale thefts typically involve the illicit acquisition of private keys, Chen emphasized that the perpetrators did not actually obtain any private keys belonging to the platform’s wallets. Instead, the attackers exploited a vulnerability within Bitget’s internal wallet management system, allowing them to submit fabricated transaction data that the system accepted as legitimate. According to Chen, the hackers managed to gain unauthorized access to the backend services that handle the exchange’s custodial wallets.
By infiltrating this layer of the infrastructure, they were able to manipulate the data packets that convey transaction instructions. The forged data mimicked the format of genuine transfer requests, effectively “spoofing” the system into believing that the movements of funds were authentic.
As a result, the exchange processed a series of counterfeit withdrawals that culminated in the loss of approximately $351.6 million. The breach highlights a critical distinction between two primary attack vectors in the crypto space: the theft of private keys and the manipulation of transaction metadata.
Private keys are cryptographic secrets that grant direct control over blockchain addresses; if an attacker acquires a private key, they can unilaterally move assets on the underlying ledger. In Bitget’s case, however, the private keys remained secure. The exchange’s on‑chain accounts were never directly compromised.
Instead, the attackers operated within the exchange’s off‑chain environment, where transaction requests are aggregated, validated, and signed before being broadcast to the blockchain. By tampering with this off‑chain process, the criminals were able to generate seemingly valid withdrawal orders without ever needing the actual cryptographic keys that protect the funds on chain. Chen’s explanation underscores the importance of robust internal controls and multi‑layered security measures that extend beyond mere key management.
While many crypto platforms invest heavily in hardware security modules (HSMs) and cold‑storage solutions to safeguard private keys, the Bitget incident demonstrates that vulnerabilities in the surrounding infrastructure—such as API endpoints, transaction queuing systems, and authentication mechanisms—can be equally exploitable. In response to the attack, Bitget has reportedly initiated a comprehensive security audit, focusing on the integrity of its transaction processing pipeline, access controls, and monitoring systems. The incident also raises broader questions about industry best practices for custodial exchanges. Experts suggest that a combination of real‑time anomaly detection, strict segregation of duties, and multi‑factor authentication for internal staff can mitigate the risk of similar spoofing attacks.
Additionally, implementing cryptographic signing of transaction data at multiple stages, coupled with immutable logging, can provide an audit trail that makes it more difficult for malicious actors to insert fraudulent instructions without detection. From a regulatory perspective, the Bitget hack may prompt authorities to scrutinize the operational resilience of crypto custodians more closely. Regulators in several jurisdictions have already begun drafting guidelines that require exchanges to demonstrate not only the security of private keys but also the robustness of their internal transaction handling processes. The incident serves as a concrete example of why oversight bodies are increasingly interested in the end‑to‑end security posture of digital asset service providers.
For users of Bitget and similar platforms, the breach is a reminder to remain vigilant about the risks associated with keeping large balances on centralized exchanges. While custodial services offer convenience and liquidity, they also introduce a layer of trust that places users’ assets under the control of third‑party operators. Diversifying holdings across multiple wallets, including hardware wallets that keep private keys offline, can reduce exposure to systemic failures or targeted attacks on a single platform.
In summary, Bitget’s $351.6 million loss was not the result of stolen private keys but rather a sophisticated spoofing operation that exploited weaknesses in the exchange’s transaction processing infrastructure. CEO Gracy Chen’s clarification on X sheds light on the nuanced nature of crypto security threats and emphasizes the need for comprehensive safeguards that address both cryptographic and operational vulnerabilities. As the industry continues to evolve, stakeholders—from exchange operators to regulators and end users—must prioritize a holistic approach to security to prevent future incidents of this magnitude.