Bitget confirms $351.6M crypto hack and suspends withdrawals

Bitget is in the news today after the exchange’s security team spotted suspicious movements from a few of the exchange’s online wallets. As it stands, assets worth around $351.6M are said to be affected. According to the exchange, its protection funds should be large enough to cover any losses. 

Bitget’s security systems first noted what’s happening on 24th September at 18:31 UTC. They alerted their emergency team, who looked into it, and discovered flagged addresses receiving the transfers.

​Here, it’s worth noting that the initial estimates were lower as blockchain analysis company Bubblemaps found that roughly $192M had been drained from the wallets through different networks.

These transfers included Ether, BNB, Avalanche, Tether, USDC and gold-backed XAUT. Some assets were sent to one address before being distributed across several others.

The latest estimate from Bitget of $351.6M in stolen assets tells us that there is more to the attack than could be extracted from blockchain analyses.

At the time of writing, Bitget had not provided a complete list of affected wallets from the most recent attack, and their reasons for the difference in the amount extracted are yet to be known.

The attack did not completely comprise the entire wallets held on Bitget and was only limited to portions of the company’s warm and hot wallet systems, according to Bitget CEO Gracy Chen. Hot wallets are those that are connected to the Internet so that the exchange can process transactions fast, although this exposes them to slightly more risk than the offline cold wallets.

Bitget also stated that its cold wallets and a majority of platform assets were not affected. As it stands, the root cause of the incident is still being investigated. 

Can Bitget’s protection fund cover the losses?

Bitget also claimed that its user funds remain protected because the incident falls within the coverage of its User Protection Fund.

The fund has more than $464 million, according to the exchange, meaning the estimated losses amount to about 76% of its declared worth.

What was not addressed by Bitget, however, was whether the fund would be used immediately or whether some of the stolen assets would be frozen or recovered first. Law enforcement officials and blockchain-security companies have already been contacted for assistance.

​Deposits and trading are working, but users are not able to withdraw funds whilst the exchange carries out its security assessment. According to Bitget, withdrawals would return once it is safe to reopen them.

Chen also promised regular updates and said a full report covering the cause of the breach and Bitget’s response would be published within 24 hours.

Final Summary

• Bitget believes that around $351.6M in assets could have been subjected to an unauthorized transaction.
• Withdrawals remain frozen, but deposits and trading functions are still possible.