Major Exchange hack drains $351M in crypto

TLDR

Crypto exchange Bitget was hacked for about $351.6 million from its hot and warm wallets, but says its user protection fund fully covers the loss and user balances remain intact.

1. Bitget detected unauthorized transfers of roughly $351.6 million from parts of its hot and warm wallet infrastructure at 18:31 UTC on 24 Sep, then paused withdrawals while investigating the breach.
2. Attackers reportedly compromised a backend wallet system and spoofed transaction data rather than stealing private keys, highlighting a sophisticated infrastructure level exploit covered by Bitgets $464 million protection fund.
3. Investigators see strong but still preliminary signs pointing to North Korea linked hackers, while other exchanges and wallet providers are tightening security, and Bitget prepares a full incident report and withdrawal restart.

Deep Dive

1. What Happened At Bitget

Bitget has confirmed a security breach involving unauthorized transfers totaling about $351.6 million from a limited set of hot wallets within its three tier wallet system, detected at 18:31 UTC on 24 Sep and followed by an immediate halt to withdrawals and activation of emergency procedures. The exchange says the incident was contained to hot and warm wallet layers, its cold wallets remained secure, and the affected amount falls entirely within its User Protection Fund of more than $464 million, meaning customer account balances will be honored in full even while withdrawals are suspended. These core details are laid out in Bitget focused coverage on the CoinsKid community site, which explains the scope of the breach and the protection fund coverage in detail.

2. How The Exploit Worked And Why It Matters

According to Bitgets CEO, attackers did not obtain private keys for cold, hot or warm wallets, but instead infiltrated a critical backend system tied to wallet infrastructure, manipulated transaction records, and tricked Bitgets own authorization process into approving fraudulent transfers, as summarized in a technical breakdown of the incident. This kind of backend authorization spoofing bypasses traditional key theft defenses and shows that centralized exchanges must harden internal signing and transaction validation flows, not just key storage, even when large reserve funds exist to absorb headline losses.

3. Attribution, Market Impact, And Next Steps

Bitget and external analysts say preliminary forensic work has identified IP address patterns and tactics consistent with North Korea linked groups such as Lazarus, though attribution remains officially unconfirmed, with CNBC reporting that the exchange currently treats North Korean involvement as a strong but still investigatory hypothesis. On chain analytics show the stolen assets were quickly consolidated and swapped across multiple networks and assets, including large amounts of XRP, ETH, USDT and USDC, making recovery harder and emphasizing the need for rapid collaborative tracing across chains. In parallel, other platforms are responding, with Binance announcing new real time wallet protections for high risk DeFi signatures shortly after the Bitget hack, and Bitget promising a full root cause report and corrective measures alongside a timeline for resuming withdrawals once its review is complete.

Conclusion

The Bitget hack is one of the largest confirmed centralized exchange incidents this year, yet it also demonstrates that robust protection funds and cold wallet segregation can shield users from direct monetary loss even when operational wallets are heavily drained. The more important lesson for crypto participants is that infrastructure level exploits and centralized custody risks remain active threats, so monitoring how Bitgets investigation, withdrawal restart and industry wide security upgrades unfold over the coming days will be key to judging whether confidence in similar venues should tighten or recover.