Bitget Confirms $351.6M Spoofed Transfer Breach, Withdrawals Suspended

On September 24-25, 2026, four independent news sources confirmed that Bitget suffered a $351.6 million security breach involving spoofed transfers from its hot wallets, not a private key compromise. CEO Gracy Chen stated on X that attackers compromised a wallet backend and spoofed transaction data, while a preliminary investigation found IP addresses matching VPN choices associated with a DPRK hacking group. The breach affected Bitget exchange hot wallets, with a newly created wallet draining reserves across multiple blockchains in under an hour.

Bitget has suspended withdrawals and said losses will be covered by its User Protection Fund. These confirmed Bitget developments carry direct operating implications for exchange users, wallet administrators, and the broader crypto custody workflow.

Spoofed Transfers, Not Key Theft: What the Sources Confirm

According to CoinDesk, Bitget CEO Gracy Chen confirmed that the $351.6 million loss resulted from attackers compromising a wallet backend and spoofing transaction data, not from private key theft. The Block separately reported that Bitget stated private keys were not compromised. Decrypt detailed that a newly created wallet drained both hot and cold reserves labeled as belonging to Bitget across multiple blockchains in under an hour.

Cointelegraph added that Bitget said unauthorized transfers affected a limited number of hot wallets, while cold wallets and most platform assets remained unaffected. The confirmed technical mechanism is backend spoofing, not key exfiltration, which changes how security teams assess vulnerability.

Exchange Users, Wallet Operations, and Market Impact

Bitget exchange users are directly affected: withdrawals remain suspended as of September 25, with CEO Gracy Chen promising a full incident report within 24 hours. The exchange's internal wallet operations team faces a forensic review of the compromised backend. The Block noted that the incident did not affect Bitget's separate self-custodial Bitget Wallet product, so users of that product are not impacted.

The broader crypto market is affected by the precedent: a wallet backend spoof that bypasses private key protections introduces a new attack vector that other exchanges must audit. Cointelegraph reported that Bitget's User Protection Fund will cover losses, meaning the exchange's treasury, not user balances, bears the financial hit.

Why the Operating Impact Matters Now

The operating impact is immediate and concrete. Bitget suspended withdrawals after detecting the unauthorized transfers, freezing liquidity for users. The User Protection Fund commitment, reported by The Block, means the exchange absorbs the $351.6 million loss rather than socializing it across customers, but the fund's size and sufficiency remain unverified. Decrypt's report that the drain happened in under an hour underscores the speed required for future attack detection.

Cointelegraph's report that IP addresses match DPRK-linked VPN choices adds geopolitical risk but does not change the operational need for backend audit controls. For other exchanges, the spoofed-transfer mechanism demands a review of wallet backend authentication, not just key management.

What to Confirm Next: Source-Document Checks Remain

Several details still require source-document verification. The full incident report promised by CEO Gracy Chen within 24 hours has not yet been published. The specific blockchains and assets drained, referenced in Decrypt's report, have not been itemized in a public ledger. The User Protection Fund's current balance and claims process, cited by The Block, lack independent audit confirmation. The IP address evidence linking to a DPRK group, reported by Cointelegraph, is preliminary and has not been corroborated by external forensic firms.

Readers should watch for Bitget's official incident report and on-chain proof of fund coverage before treating all details as final.

Reference

• https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says
• https://cointelegraph.com/news/bitget-ceo-suspects-north-korea-behind-352m-hack-citing-ip-clues
• https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets
• https://www.theblock.co/news/markets/2026-09-24-more-than-170-million-in-crypto-moves-from-bitget-wallets-unidentified-address-416345
• https://cointelegraph.com/news/bitget-calls-security-withdrawal-claims-unverified-amid-178m-breach-reports