Crypto exchange Bitget says attackers did not steal private keys or forge user withdrawal requests when they moved about $351.6 million from the exchange on Thursday.
Instead, the company says an attacker compromised a critical backend system in its wallet infrastructure, used it to spoof transaction data and triggered Bitget’s own authorisation process to move the funds.
CEO Gracy Chen disclosed the breach at 19:31 WAT on September 24, saying the exchange had detected unauthorised transfers from some of its hot wallets. The company subsequently suspended withdrawals while deposits and trading remained operational.
In a follow-up explanation on Friday, Chen said the attacker had compromised a backend system rather than obtaining the private keys controlling Bitget’s wallets.
“Private key compromise has been ruled out,” Chen said, according to reports of her statement.
The exact method used to gain access to the backend system remains under investigation. Bitget said it plans to publish a full incident report covering the root cause and corrective measures.
Bitget points to possible North Korean link
Chen also said preliminary findings had identified similarities between the attack and previous operations linked to North Korean hacking groups.
According to Chen, investigators found IP addresses whose VPN usage matched choices associated with a North Korean group. She also said the pattern of the attack appeared similar to previous operations attributed to North Korean hackers.
Read also: Bitget Wallet’s direct bank transfer, explained
The claim has not been independently confirmed, and Bitget has not identified the attackers. The exchange said investigations involving law enforcement agencies and on-chain security firms are ongoing.
North Korean-linked hackers have previously been associated with major cryptocurrency thefts. The FBI attributed the February 2025 theft of about $1.5 billion from the crypto exchange Bybit to North Korea.
Cold wallets remain unaffected
Bitget said the incident was limited to portions of its hot and warm-wallet infrastructure, while its cold wallets remained secure.
Hot wallets are connected to the internet and are commonly used to facilitate transactions, while cold wallets are kept offline to reduce exposure to online attacks.
The exchange said customer account balances remain accurate and that the estimated loss is covered by its User Protection Fund, which currently holds more than $464 million.
Bitget has flagged addresses associated with the transfers and said it has contacted law enforcement agencies and on-chain security firms as part of efforts to investigate and recover the assets.
The company has not given a date for when withdrawals will resume. It said restoration would take place after its security review is completed and that updates would be provided through its official channels.
Nigerian users
The incident also comes as Bitget has built a significant presence among cryptocurrency users in Nigeria.
Bitget Wallet, the exchange’s separate self-custody wallet product, was previously ranked No. 1 in both the overall and finance categories of Apple’s App Store in Nigeria. The company said its Nigerian Wallet user base grew by more than 233% in June 2024.
However, the company said the Wallet product operates separately from the exchange infrastructure affected by Thursday’s incident.
The breach affects funds held in the Exchange’s hot and warm wallets, while the separate Wallet was not affected, according to Chen.
Bitget detected the unauthorised transfers at 19:31 WAT on September 24 and said its emergency response team was activated within minutes. The exchange has promised further updates as its investigation continues.
Technext Newsletter
Get the best of Africa’s daily tech to your inbox – first thing every morning.
Join the community now!
