In a detailed statement posted on the social platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive security breach that resulted in the loss of roughly $352 million from the exchange’s custodial wallets. Contrary to early speculation that the hackers might have obtained private keys or directly accessed the underlying blockchain accounts, Chen emphasized that the perpetrators exploited a vulnerability in the company’s internal wallet management system. By spoofing transaction data—essentially fabricating or altering the information that tells the system how funds should move—they were able to redirect assets without ever needing the cryptographic keys that normally protect a wallet. ### How the Attack Unfolded According to the CEO’s account, the attackers first gained unauthorized access to a backend component that handles wallet operations.
This component is responsible for aggregating user deposits, managing internal ledger entries, and preparing outbound transactions for broadcasting to the blockchain. Once inside, the malicious actors did not attempt to steal the private keys themselves. Instead, they manipulated the transaction payloads that the system uses to construct withdrawal requests.
By feeding the wallet service false data—such as forged destination addresses and inflated amounts—the hackers tricked the platform into believing that legitimate, high‑value withdrawals were being requested by genuine users. The forged transactions were then signed by the system’s own custodial keys, which were legitimately stored and managed by Bitget’s infrastructure.
Because the signatures were valid, the blockchain network accepted the transfers as authentic, and the funds were moved to addresses controlled by the attackers. In effect, the breach was a classic case of internal process subversion rather than a direct cryptographic compromise.
This nuance is critical: the private keys remained secure, but the procedural safeguards that verify the integrity of transaction data were bypassed. ### Scope and Financial Impact The total amount siphoned off in the incident is reported to be $351.6 million, a figure that places the event among the largest cryptocurrency thefts in history. The loss spanned multiple digital assets, with the majority of the value held in stablecoins and major cryptocurrencies such as Bitcoin and Ethereum. Bitget has indicated that the stolen funds were transferred across a series of wallets in rapid succession, a tactic often employed by cyber‑criminals to obfuscate the trail and make recovery more difficult.
### Immediate Response and Mitigation Efforts Following the discovery of the breach, Bitget’s security team initiated a full forensic investigation, enlisting third‑party cybersecurity firms to audit the compromised systems and trace the flow of funds. The exchange also temporarily suspended all withdrawals to prevent further unauthorized outflows while it reinforced its internal controls. Chen noted that the company is implementing a suite of additional safeguards, including multi‑factor authentication for internal staff, stricter segregation of duties within the wallet management workflow, and enhanced monitoring of transaction anomalies using machine‑learning models.
In parallel, Bitget has begun cooperating with law enforcement agencies across several jurisdictions. The exchange has shared blockchain analytics, transaction hashes, and other forensic data with investigators in hopes of identifying the perpetrators and possibly recovering a portion of the stolen assets.
While the immutable nature of blockchain transactions makes reversal impossible, law‑enforcement collaborations have, in past cases, led to the seizure of illicit funds when they are moved through centralized exchanges that comply with legal requests. ### Industry Implications The incident underscores a growing awareness that the security of cryptocurrency platforms extends beyond the protection of private keys. While cryptographic security remains a cornerstone of blockchain technology, the surrounding infrastructure—wallet services, API endpoints, and internal transaction processing engines—represents an equally critical attack surface. Spoofing attacks, where malicious actors falsify data to manipulate system behavior, have been documented in traditional finance and are now emerging as a potent threat vector in the digital asset space.
Experts suggest that exchanges should adopt a defense‑in‑depth strategy that incorporates rigorous code reviews, continuous penetration testing, and real‑time anomaly detection. Moreover, the implementation of transaction approval workflows that require multiple independent sign‑offs can reduce the risk of a single compromised account being used to authorize large withdrawals. ### What Users Should Know For Bitget’s customers, the primary concern is the safety of their remaining balances.
The exchange has pledged to compensate affected users according to its insurance policies and internal risk reserves, though the exact mechanism and timeline for restitution have not been fully disclosed. Users are advised to enable all available security features on their accounts, such as two‑factor authentication, withdrawal whitelist addresses, and device management tools. Additionally, the broader crypto community is reminded to diversify holdings across multiple platforms and, where feasible, retain personal custody of assets using hardware wallets. While custodial services offer convenience, they also concentrate risk, making them attractive targets for sophisticated attackers.
### Looking Ahead Bitget’s CEO, Gracy Chen, concluded her statement by reaffirming the company’s commitment to transparency and user protection. She emphasized that the breach, while severe, has prompted a comprehensive overhaul of the exchange’s security architecture. The incident serves as a cautionary tale for the entire industry, highlighting the need for continuous vigilance, robust internal controls, and rapid response capabilities in the face of evolving cyber threats. As the investigation proceeds and law‑enforcement agencies work to track the stolen funds, the crypto sector will be watching closely to see how Bitget navigates the recovery process and what lessons can be drawn to fortify the ecosystem against similar attacks in the future.