Bitget Breach Sees $351.6M in Assets Stolen from Hot and Warm Wallets

Bitget has confirmed that an attacker breached its security systems and stole $351.6 million worth of assets, including Ethereum, XRP, Tether, USD Coin, Avalanche, and a token called USDT0 on the Arbitrum network.

The breach occurred at 6:31 pm UTC on September 24th when Bitget's security systems flagged unauthorized transfers, prompting emergency response measures. The exchange has paused withdrawals as a precaution while it investigates further.

According to CEO Gracy Chen, the attacker gained access to Bitget's back-end system and pushed fake transaction data through the approval process to release funds. This was different from a stolen private key, as the cryptographic keys controlling the exchange's custodial wallets remained secure.

The cold wallets, which store assets offline, were untouched by the breach, but the hot and warm layers of Bitget's three-tier custody setup were compromised. The stolen assets include Ethereum (ETH), XRP, Tether (USDT), USD Coin (USDC), Avalanche (AVAX), and USDT0 on Arbitrum.

Bitget has confirmed that the full loss is covered by its User Protection Fund, which currently holds over $464 million. The exchange has also committed to posting hourly updates and publishing a complete incident report within 24 hours of the breach.