Bitget hit by $351.6m hack as protection fund absorbs loss

Crypto exchange Bitget has been hit by a major security incident, with around $351.6 million in crypto drained from some of its hot wallets. The attack occurred on 24 September at 18:31 UTC. Bitget has temporarily suspended withdrawals, but says user balances remain intact and cold wallets stayed safe. A protection fund worth more than $464 million should be enough to cover the full loss.

Bitget sees unauthorised transactions from wallets

According to CEO Gracy Chen, Bitget’s security systems detected unauthorised transactions from a limited number of hot wallets. The security team then activated emergency procedures.

The initial estimate puts the affected assets at around $351.6 million. According to Bitget, the attack was limited to part of its hot wallet infrastructure. The cold wallets, which hold the majority of assets, were reportedly unaffected.

Bitget stresses that customer balances remain correct. Trading and deposits are also still possible. Only withdrawals have been temporarily disabled while the company checks its systems.

The exchange has now identified and flagged the addresses to which the stolen crypto is being sent. It has also brought in investigative services and companies specialising in on-chain security.

$464 million protection fund should cover loss

For users, Bitget’s User Protection Fund is particularly important. According to the company, the fund holds more than $464 million, making it larger than the provisional estimated loss of $351.6 million.

The fund is said to hold around 5,500 Bitcoin. Bitget says the full loss falls within the coverage of this protection fund and that the fund will be replenished after use.

The company says it intends to provide hourly updates. A full report with more information on the cause of the incident and the measures Bitget is taking to prevent a repeat is due within 24 hours.

While the investigation is ongoing, Bitget does not want to draw final conclusions about the attack method used.

Possible North Korea link under investigation

According to the information shared, Chen says there are indications of a possible link to North Korean hackers. Certain IP addresses reportedly show similarities with VPN infrastructure previously used by a North Korean group.

That is not yet a definitive attribution. Bitget itself says the investigation into the attack is still ongoing.

Notably, Bybit is also offering help. CEO Ben Zhou says his team is ready to support Bitget. Bitget previously helped Bybit after its own hack. Bybit is now updating its LazarusBounty platform to help track the stolen crypto.

The main question for users is when withdrawals will become available again. Bitget says it will only resume them once the security check has been completed and the company considers it safe.