Bitget confirms $351.6M crypto hack and suspends withdrawals

After suspicious movements were noted from a few of Bitget’s online wallets, the site temporarily removed permission for withdrawals.

It was thought that around $351.6m of assets were impacted. Balances remain right, and the exchange’s protection funds are large enough to cover the loss.

Bitget reports unauthorized wallet transfers

On September 24 at 18:31 UTC, the exchange’s security systems spotted the transfers, said Bitget. They alerted their emergency team, who looked into it and discovered flagged addresses receiving the transfers.

​However, the initial estimates were lower, as blockchain analysis company Bubblemaps found that roughly $192 million had drained from the wallets through different networks.

Those transfers included Ether, BNB, Avalanche, Tether, USDC and gold-backed XAUT. Some assets were sent to one address before being distributed across several others.

The latest prediction from Bitget of another $351.6 million in stolen money tells that there is more to the attack than could be extracted from blockchain analyses.

To date, Bitget has not provided a complete list of affected wallets from the most recent attack, and their reasons for the difference in the amount extracted are yet to be known.

The attack did not completely comprise the entire wallets held on Bitget and was only limited to portions of the company’s warm and hot wallet systems, the Bitget CEO Gracy Chen said. Hot wallets are those that are connected to the internet so that the exchange can process transactions fast, although this exposes them to slightly more risk than the offline cold wallets.

Bitget states that its cold wallets and a majority of platform assets were not affected, while the root cause of the incident continues to remain unknown.

Can Bitget’s protection fund cover the loss?

Bitget says user funds remain protected because the incident falls within the coverage of its User Protection Fund.

The fund has more than $464 million, according to the exchange, meaning its estimated loss amounts to about 76% of its declared worth.

What is not addressed by Bitget, however, is whether the fund would be used straightaway or whether some of the stolen assets could be frozen or recovered first. Law officials and blockchain-security companies were already contacted for assistance.

​Deposits and trading are working, but users are not able to withdraw funds whilst the exchange carries out its security assessment. Bitget said that withdrawals would return once it is safe to reopen them.

Chen promised regular updates and said a full report covering the cause of the breach and Bitget’s response would be published within 24 hours.

Final Summary

• Bitget assesses that around $351.6 million could have been subjected to an unauthorized transaction.
• Withdrawals remain frozen, but deposits and trading function remains.