Bitget says attackers drained approximately $351.6 million after compromising a backend system in its wallet infrastructure and spoofing transaction data. CEO Gracy Chen said the forged data triggered the exchange’s own authorization process; the company has ruled out private-key compromise in its preliminary investigation.

The exchange detected unauthorized transfers at 18:31 UTC on September 24. Chen said the breach affected part of its hot- and warm-wallet layers, while cold wallets remained secure. CoinDesk reported the same loss estimate and account of the attack on September 25.

Withdrawals remain paused

In the statements reviewed for this report, Bitget said deposits and trading remained operational, but withdrawals were suspended pending a security review. Chen’s subsequent update did not give a restoration deadline, saying technical teams were working on remediation and security hardening.

The company said its User Protection Fund held more than $464 million and that the estimated loss fell within that coverage. Those assurances, including statements that customer balances were accurate and assets protected, are Bitget’s claims rather than an independent audit of its reserves or liabilities.

Authorization is part of the attack surface

The reported mechanism points to a distinction between stealing signing keys and manipulating the systems that request authorized transfers. Protecting keys alone does not establish that a withdrawal request is legitimate.

Chen said unauthorized outflows had been contained, but the specific intrusion method remained under investigation. Bitget promised a technical report. Until that is published, the backend explanation should be treated as a preliminary company finding, not a complete forensic account.