Cryptocurrency exchange Bitget suffered a security breach resulting in the theft of approximately $387.5 million. Unauthorized transfers from hot wallets were detected on September 24 at 18:31 UTC. The incident is currently considered the largest crypto hack of the year.
CEO Gracy Chen stated that attackers compromised a backend system within the wallet infrastructure to spoof transaction data, tricking the authorization process. The breach did not involve forging user withdrawal requests or obtaining private keys. The outflow has since been halted.
The stolen assets included various cryptocurrencies, with the largest portion consisting of approximately 103 million XRP, valued at about $157 million. On-chain investigators also tracked the purchase of 7,111 ETH using $19.67 million in USDT.
Bitget plans to cover all losses using its User Protection Fund, which currently holds over $464 million. This fund was established in 2023 with an initial value of $300 million. Customer account balances remain intact, though withdrawals were temporarily frozen.
The exchange is investigating the incident alongside security firms Mandiant and SlowMist. CEO Gracy Chen noted that IP addresses and on-chain techniques align with patterns previously associated with North Korean state-linked hacking groups, though the identity remains unconfirmed.
