Bitget confirms $387.5 million security breach affecting exchange hot wallets

Crypto exchange Bitget said unauthorized transfers from some of its hot wallets withdrew approximately $387 million in assets on Thursday.

The transfers were detected at 6:31 p.m. UTC on Sept. 24, Bitget said. The exchange suspended withdrawals and identified and flagged the addresses involved.

Bitget CEO Gracy Chen said the attacker had compromised a critical backend system within Bitget's wallet infrastructure. According to Chen, the attacker spoofed transaction data and invoked the authorization process to move funds out.

On Friday morning, Bitget said onchain tracing confirmed $387.5 million was transferred to attacker-controlled addresses, up from the previously reported $351.6 million after adding Zcash and Tron assets. The exchange said the higher figure does not reflect additional theft and that the incident remains contained.

Private keys were not compromised, Chen said. Bitget also said its cold wallets were unaffected.

A Bitget spokesperson told The Block that the affected wallets were custodial wallets operated by Bitget's centralized exchange. Bitget Wallet, the company's separate self-custodial wallet product, was not affected. The two operate on separate infrastructure, the spokesperson said.

The Block observed hundreds of millions of dollars moving from Bitget-labeled wallets to a fresh address as the incident unfolded. Ether, USDT, USDC, AVAX, and BNB were among the assets transferred. The address later began swapping some of the funds onchain.