Crypto exchange Bitget confirmed the theft of cryptocurrency by about $351.6 million, but in recent hours the first technical details of the attack appeared. According to the preliminary results of the investigation, the intruder did not steal private keys. Instead, the attacker gained access to the critical backend system of the purse infrastructure, replaced the transaction data and forced the full-time authorization mechanism to sign transfers. The withdrawal from the exchange is still stopped.
Bitget's security system detected unauthorized transfers on September 24 at 18:31 UTC. The incident affected some of the hot purses and the intermediate warm layer. Cold wallets, where the exchange stores assets outside the permanently connected infrastructure, the company calls intact.
The head of Bitget Gracie Chen later clarified the mechanism of the attack. According to her, the attacker compromised one of the critical systems inside the wallet infrastructure, formed fake transfer data and transferred them further along the legitimate authorization chain. Bitget considers the leak of private keys excluded and claims that the further unauthorized withdrawal is already blocked. How the attacker initially penetrated the backend, the investigation has not yet established.
This difference is fundamental. When stealing private keys, the attacker gets the opportunity to sign transactions from controlled addresses on his own until the funds are transferred to new wallets. In the Bitget scenario described, the keys could remain secure, but the system before them received a false command and authorized the translation itself. In fact, the attacker did not deceive the blockchain, but the trusted internal circuit, which decided which transaction should be signed.
Bitget involved Mandiant and SlowMist specialists in the investigation. At the same time, the company reported that a separate non-custodial Bitget Wallet works on other infrastructure and was not damaged. Users of such a wallet independently control private keys, so the incident of the centralized exchange directly did not affect their assets.
Independent blockchain analysis provides a slightly larger assessment of the damage. The latest breakdown of Lookonchain's assets counted about $356.8 million. The list included 102.93 million XRP worth $157.48 million, 31,890 ETH for $85.75 million, USDT 34.75 million, USDC 21.05 million, USD 19.67 million USD₮0, 3000 XAUt for $12.8 million, 12,719 BNB The difference from the official $351.6 million by about $5 million can be explained by the time of valuation and change in the rate of stolen assets.
In the first hours, the scale of the attack looked noticeably smaller, as observers saw primarily transfers in EVM-compatible networks. Later, analysts added a major XRP withdrawal and operations on other blockchains. It was 102.93 million XRP that was the largest single part of the stolen portfolio.
A significant part of the assets in EVM networks was quickly converted into 67 982 ETH worth about $183 million. Such tactics complicate the blocking of funds. Centralized stablecoins allow issuers to restrict the movement of coins on specific addresses. For example, Circle explicitly provides for blocking USDCs related to illegal activities.
With XRP the situation is even tougher. The XRP Ledger documentation explicitly indicates that native XRP cannot be frozen by means of protocol. You can freeze the tokens released on top of XRP Ledger, but not the XRP itself. Therefore, Bitget's reports about blocking part of the attack-related assets do not mean that the largest 102.93 million XRP automatically became inaccessible to the attacker.
There is also a preliminary version about the authors of the attack. Chen said the IP addresses studied and the choice of VPN infrastructure are similar to patterns that were previously linked to North Korean groups. Additional suspicions caused an analysis of the movement of part XRP, where researchers found a possible connection with the July hacking of AFX. So far, the attribution remains preliminary. Neither Bitget nor the involved investigators have published technical evidence sufficient for a final finding of North Korea's involvement.
The North Korean footprint looks plausible in the context of previous major crypto charts, but the past experience itself does not prove anything. In February 2025, the FBI officially linked the DPRK to the theft of approximately $1.5 billion from Bybit and called the TraderTraitor operation. According to Chainalysis, for the whole of 2025, North Korean groups stole at least $2.02 billion in cryptocurrency.
Bitget claims that the customer funds are fully protected by the User Protection Fund. The fund consists of 5500 BTC, so its dollar value changes along with the bitcoin rate. At the time of the initial statement, the company estimated the reserve at more than $464 million, which exceeded its own estimate of losses of $ 351.6 million. The existence of the fund is not yet an independent confirmation of compensation, since Bitget has not yet published the results of the inspection and the actual movement of funds from the fund.
A week before the hack, the exchange also published the September Proof of Reserves with a combined ratio of 135% for 19 tracked assets. This check shows the ratio of declared reserves and user balances at the time of the image, but does not itself answer questions about the security of backend systems, transaction signature mechanisms or the reasons for the current compromise.
The operational impact of the attack continues. The withdrawal of cryptocurrency remains suspended, and a separate service Bitget Onchain is temporarily unavailable. The Exchange first stated that deposits and regular trade were functioning, but on the morning of 25 September, it was separately warned of deposit delays. The company does not yet call the date of recovery of the withdrawal.
Bitget promised to publish a full report with an analysis of the root cause and the measures taken within 24 hours of the discovery of the attack, that is, approximately until 18:31 UTC on September 25. At the time of the last check of a separate technical report, the official support center has not yet appeared.
The main issue of the investigation has now shifted from private keys to the internal architecture of confidence. It is necessary to find out how the attacker gained access to the backend system, why fake data reached the signature mechanism, what checks were to stop abnormal transfers and why they did not work before the withdrawal of hundreds of millions of dollars. Prior to the publication of the technical report, any more specific versions, including the compromise of a third-party vendor or attribution to a particular hacker group, remain hypotheses.
Bitget's security system detected unauthorized transfers on September 24 at 18:31 UTC. The incident affected some of the hot purses and the intermediate warm layer. Cold wallets, where the exchange stores assets outside the permanently connected infrastructure, the company calls intact.
The head of Bitget Gracie Chen later clarified the mechanism of the attack. According to her, the attacker compromised one of the critical systems inside the wallet infrastructure, formed fake transfer data and transferred them further along the legitimate authorization chain. Bitget considers the leak of private keys excluded and claims that the further unauthorized withdrawal is already blocked. How the attacker initially penetrated the backend, the investigation has not yet established.
This difference is fundamental. When stealing private keys, the attacker gets the opportunity to sign transactions from controlled addresses on his own until the funds are transferred to new wallets. In the Bitget scenario described, the keys could remain secure, but the system before them received a false command and authorized the translation itself. In fact, the attacker did not deceive the blockchain, but the trusted internal circuit, which decided which transaction should be signed.
Bitget involved Mandiant and SlowMist specialists in the investigation. At the same time, the company reported that a separate non-custodial Bitget Wallet works on other infrastructure and was not damaged. Users of such a wallet independently control private keys, so the incident of the centralized exchange directly did not affect their assets.
Independent blockchain analysis provides a slightly larger assessment of the damage. The latest breakdown of Lookonchain's assets counted about $356.8 million. The list included 102.93 million XRP worth $157.48 million, 31,890 ETH for $85.75 million, USDT 34.75 million, USDC 21.05 million, USD 19.67 million USD₮0, 3000 XAUt for $12.8 million, 12,719 BNB The difference from the official $351.6 million by about $5 million can be explained by the time of valuation and change in the rate of stolen assets.
In the first hours, the scale of the attack looked noticeably smaller, as observers saw primarily transfers in EVM-compatible networks. Later, analysts added a major XRP withdrawal and operations on other blockchains. It was 102.93 million XRP that was the largest single part of the stolen portfolio.
A significant part of the assets in EVM networks was quickly converted into 67 982 ETH worth about $183 million. Such tactics complicate the blocking of funds. Centralized stablecoins allow issuers to restrict the movement of coins on specific addresses. For example, Circle explicitly provides for blocking USDCs related to illegal activities.
With XRP the situation is even tougher. The XRP Ledger documentation explicitly indicates that native XRP cannot be frozen by means of protocol. You can freeze the tokens released on top of XRP Ledger, but not the XRP itself. Therefore, Bitget's reports about blocking part of the attack-related assets do not mean that the largest 102.93 million XRP automatically became inaccessible to the attacker.
There is also a preliminary version about the authors of the attack. Chen said the IP addresses studied and the choice of VPN infrastructure are similar to patterns that were previously linked to North Korean groups. Additional suspicions caused an analysis of the movement of part XRP, where researchers found a possible connection with the July hacking of AFX. So far, the attribution remains preliminary. Neither Bitget nor the involved investigators have published technical evidence sufficient for a final finding of North Korea's involvement.
The North Korean footprint looks plausible in the context of previous major crypto charts, but the past experience itself does not prove anything. In February 2025, the FBI officially linked the DPRK to the theft of approximately $1.5 billion from Bybit and called the TraderTraitor operation. According to Chainalysis, for the whole of 2025, North Korean groups stole at least $2.02 billion in cryptocurrency.
Bitget claims that the customer funds are fully protected by the User Protection Fund. The fund consists of 5500 BTC, so its dollar value changes along with the bitcoin rate. At the time of the initial statement, the company estimated the reserve at more than $464 million, which exceeded its own estimate of losses of $ 351.6 million. The existence of the fund is not yet an independent confirmation of compensation, since Bitget has not yet published the results of the inspection and the actual movement of funds from the fund.
A week before the hack, the exchange also published the September Proof of Reserves with a combined ratio of 135% for 19 tracked assets. This check shows the ratio of declared reserves and user balances at the time of the image, but does not itself answer questions about the security of backend systems, transaction signature mechanisms or the reasons for the current compromise.
The operational impact of the attack continues. The withdrawal of cryptocurrency remains suspended, and a separate service Bitget Onchain is temporarily unavailable. The Exchange first stated that deposits and regular trade were functioning, but on the morning of 25 September, it was separately warned of deposit delays. The company does not yet call the date of recovery of the withdrawal.
Bitget promised to publish a full report with an analysis of the root cause and the measures taken within 24 hours of the discovery of the attack, that is, approximately until 18:31 UTC on September 25. At the time of the last check of a separate technical report, the official support center has not yet appeared.
The main issue of the investigation has now shifted from private keys to the internal architecture of confidence. It is necessary to find out how the attacker gained access to the backend system, why fake data reached the signature mechanism, what checks were to stop abnormal transfers and why they did not work before the withdrawal of hundreds of millions of dollars. Prior to the publication of the technical report, any more specific versions, including the compromise of a third-party vendor or attribution to a particular hacker group, remain hypotheses.
