Bitget Hot Wallet Hack: CEO Gracy Chen Denies Key Theft

The Bitget hot wallet hack that stripped $351.6 million from the exchange overnight on September 24 didn’t look like any standard crypto breach, and CEO Gracy Chen is making sure you understand the difference. No private keys left the building. The attacker found a different seam entirely: they got inside Bitget’s backend infrastructure, learned how the exchange’s transaction approval process works, and fed it convincing forgeries. The vault was never cracked. The tellers were.

What Was the Bitget Hot Wallet Hack?

The Bitget hot wallet hack, detected at 18:31 UTC on September 24, 2026, saw attackers compromise a critical backend system within Bitget’s wallet infrastructure. Using it to spoof transaction data, they triggered the exchange’s own authorization process, moving $351.6 million in funds through channels that looked completely legitimate, no private keys required.

Hot wallets are the internet-connected cash registers of any crypto exchange. They hold the liquidity needed for instant withdrawals, trade settlements, and day-to-day deposits, without touching the offline reserves. According to Bitget’s official incident disclosure, the breach also extended into the warm-wallet layer, a semi-connected buffer that tops up hot wallets when balances run low and pulls excess capital off the internet periodically. Cold storage, Bitget’s fully offline vault, was not touched.

The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. Private key compromise has been ruled out.

How Spoofed Transfers Bypassed Bitget’s Security

Chen’s framing of the breach is worth sitting with for a moment. She described it as the digital version of slipping forged withdrawal slips through a bank’s own teller window, the vault keys never left the building, but someone got into the back office, created paperwork that looked entirely official, and sent it through the same approval channel the bank uses every day. To the authorization system, everything looked like a normal payout.

Spoofing transaction data, in this context, means constructing transfer requests that appear to originate from a legitimate internal source. The Bitget authorization system had no reason to question them, they were formatted correctly, signed through the right backend process, and matched the expected patterns. That’s what made them dangerous: not brute force, not stolen credentials, but forged context fed into a trusting system.

The breach reached both the hot wallet layer and the warm-wallet buffer sitting between the live trading tier and cold offline reserves. Breaching both tiers without touching private keys is a reminder that exchanges face more attack surfaces than just the keys themselves. Authorization logic, backend APIs, transaction formatting, any of these can become the entry point.

That’s structurally different from private key theft. When private keys are compromised, the attacker gains permanent access, they can sign new transfers from any wallet tied to those keys indefinitely, until someone catches on and rotates credentials. A spoofed backend attack has a harder ceiling. Once the compromised system is found and isolated, the fraud stops. Bitget says that’s exactly what happened: loss containment confirmed, no further unauthorized transfers possible.

The specific intrusion method “remains under active investigation,” Chen said. A full technical report will follow once the investigation concludes.

Why No Private Key Theft Is Still $352 Million Gone

Let’s not let the private-key caveat do too much heavy lifting here. According to Gracy Chen’s statement ruling out private key compromise, the reassuring part is genuine, this attack vector has a more defined blast radius than credential theft. But the number at the top of this story is still $351.6 million drained in a single overnight window. A backend system inside one of the world’s major crypto exchanges was compromised enough to fake transactions at institutional scale. That’s not a near miss.

Private key hacks drive some of the largest losses in crypto history for a reason. Every wallet has two keys: a public one, share it freely so people can send funds to you, and a private one, the secret string that proves ownership and authorizes every outgoing transfer. Losing those private keys is handing your vault combination to someone who can return whenever they choose.

The warm-wallet layer being reached deserves a separate mention. Warm wallets are designed to provide a middle tier between the always-hot trading funds and cold offline reserves. Breaching both the hot layer and the warm buffer suggests the attacker had a meaningful understanding of Bitget’s internal architecture, enough to navigate security tiers deliberately. Whether that knowledge came from internal access or extended external reconnaissance is among the questions the active investigation needs to answer.

What happened here is a full breach of a different kind. Not the kind that keeps signing new transactions from stolen keys. The kind that understands your systems well enough to impersonate them from the inside.

What Bitget’s $464M Protection Fund Means for Users

$464 million, that’s what the Bitget User Protection Fund holds, and it’s the figure that matters most to users right now. It fully covers the $351.6 million that left the exchange. CEO Gracy Chen confirmed it plainly: user funds are safe, account balances are accurate, and all assets are protected.

Deposits and trading are still running. Withdrawals are not, frozen immediately after the breach was confirmed, “as a precautionary measure, pending security review.” Chen gave no timeline on when they resume. That’s the part users are most frustrated about right now.

“Multiple technical teams are working in parallel on system remediation and security hardening,” she said in a statement. “We will announce a timeline as soon as one is confirmed, we will not commit to a window we cannot guarantee.”

That last line is either disciplined crisis communication or a careful hedge. Probably both. The protection fund covering the loss sounds clean on paper, but the real test is how long withdrawals stay frozen, and whether Bitget restores full functionality before users start voting with their feet. A $464 million cushion is reassuring. An indefinite withdrawal freeze is not.

Loss containment is confirmed. No further unauthorized transfers are possible. User funds are safe. Your account balances are accurate and your assets are protected.

This article is for informational purposes only and does not constitute investment advice. Every investment and trading decision involves risk. Readers should conduct their own research before making any financial decisions.