Daily News 19

Tag: Hot wallet breach

  • Bitget’s $352M Hack Stemmed from Spoofed Transfers, Not Private Keys, CEO Gray Chen Says

    Bitget’s $352M Hack Stemmed from Spoofed Transfers, Not Private Keys, CEO Gray Chen Says

    Key Highlights

    • Bitget exchange detected unauthorized transfers from hot wallets at 18:31 UTC on September 24, with the breach extending to the warm-wallet layer.
    • Loss containment is confirmed and no further unauthorized transfers are possible, though the specific intrusion method remains under active investigation.
    • A full technical report will be released once the investigation is confirmed, according to Bitget representative Chen.

    Breach Detection and Immediate Containment

    Bitget’s security systems flagged unauthorized transfers originating from several exchange hot wallets at 18:31 UTC on September 24, triggering an immediate response from the platform’s security team. A hot wallet, which remains connected to the internet to facilitate rapid fund movement for instant trades, deposits, and withdrawals, functions as a temporary liquidity hub analogous to an online cash drawer. The breach did not remain confined to this layer; Chen confirmed the intrusion also reached the warm-wallet tier, a semi-connected buffer that sits between automated hot wallets and fully offline cold storage, managing liquidity top-ups and pulling excess deposits off the internet to limit capital exposure.

    Anatomy of the Attack: Forged Digital Withdrawal Slips

    Describing the breach mechanism, Chen likened the exploit to the digital equivalent of slipping forged withdrawal slips through a bank’s own teller window. In this analogy, the vault keys never left the building; instead, an attacker gained access to the office responsible for preparing the slips, created paperwork that appeared official, and routed it through the same approval window the bank uses daily. To the system processing the approvals, the transactions looked like routine payouts, allowing the unauthorized outflow to proceed undetected until internal monitoring flagged the anomaly.

    Containment Confirmed, Investigation Underway

    Chen provided a definitive update on the platform’s status, stating: “Loss containment is confirmed. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation. A full technical report will follow once confirmed,” she said. The confirmation that the outflow has been stopped and no further unauthorized transfers can occur addresses the most immediate concern for users and stakeholders. However, the root cause—the specific vector used to penetrate the warm-wallet layer and manipulate the approval logic—has not yet been publicly disclosed, pending the completion of the forensic investigation.

    Why This Matters

    The incident underscores the persistent operational risk inherent in the multi-tier wallet architecture employed by centralized cryptocurrency exchanges. While cold storage remains the gold standard for asset security, the necessity of hot and warm wallets for liquidity creates attack surfaces that sophisticated actors continue to probe. Bitget’s experience highlights how attackers are shifting from brute-force key theft to logic-layer exploits—subverting legitimate approval workflows rather than cracking encryption. For the broader industry, the breach serves as a reminder that security audits must extend beyond key management to include rigorous testing of transaction validation logic, access controls for internal tooling, and real-time anomaly detection across all wallet tiers. The forthcoming technical report will be closely watched by security teams across the sector for indicators of compromise and mitigation strategies applicable to similar infrastructure.

    Frequently Asked Questions

    What wallets were affected in the Bitget breach?
    The unauthorized transfers originated from Bitget’s hot wallets—internet-connected wallets used for immediate liquidity—and the intrusion extended to the warm-wallet layer, which acts as a semi-connected buffer between hot wallets and offline cold storage.
    Has the breach been fully contained?
    Yes. According to Bitget representative Chen, loss containment is confirmed and no further unauthorized transfers are possible. The platform has secured the affected infrastructure.
    When will details on how the attack happened be released?
    A full technical report will be published once the active investigation into the specific method of system intrusion is confirmed and complete.
  • Bitget CEO Confirms Hack, Reveals Massive Losses; Withdrawals Suspended

    Bitget CEO Confirms Hack, Reveals Massive Losses; Withdrawals Suspended

    Key Highlights

    • Cryptocurrency exchange Bitget detected unauthorized transfers from hot wallets totaling approximately $351.6 million on September 24, 2026, at 18:31 UTC.
    • Cold wallets remain secure and the loss is fully covered by Bitget’s User Protection Fund, which holds over $464 million in assets.
    • Withdrawals are temporarily suspended as a precaution; deposits and trading continue normally with hourly updates promised and a full incident report due within 24 hours.

    Breach Detection and Emergency Response

    Cryptocurrency exchange Bitget released an official statement on September 24, 2026, confirming that its security systems detected unauthorized transfers from several hot wallets at 6:31 PM UTC. According to a statement by Bitget CEO Gracy Chen, the company’s security team activated emergency response protocols immediately upon detection. The exchange announced that its emergency response team was activated within minutes, the addresses where the unusual transfers occurred were identified and marked, and relevant parties were notified. Law enforcement and security companies have been officially involved in the investigation process.

    [SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026
    At 18:31 UTC on September 24, 2026, Bitget’s security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately.
    What we have…
    — Gracy Chen @Bitget (@GracyBitget) September 24, 2026

    Wallet Architecture Limits Impact

    Bitget emphasized that the incident was limited to only a portion of the hot and warm wallet layers. The company operates a three-layered wallet architecture, and cold wallets were not affected by the breach. This structural segregation prevented the compromise from extending to the majority of user funds held in offline storage. The exchange maintained that account balances are accurate and user assets are protected despite the hot wallet losses.

    User Protection Fund Coverage

    The company stated that the entire approximately $351.6 million loss could be covered by Bitget’s User Protection Fund, which holds over $464 million in assets. This reserve mechanism is designed to absorb losses from security incidents without impacting individual user holdings. Bitget reiterated that user funds are safe and the protection fund has sufficient capacity to cover the full extent of the unauthorized transfers.

    Operational Status and Next Steps

    As a precautionary measure while a security review is underway, Bitget has temporarily suspended withdrawal transactions. However, deposits and trading continue as normal. The exchange announced that withdrawals will be reopened after the security review is complete. The company committed to sharing updates on the incident hourly and publishing a comprehensive incident report detailing the cause of the attack, the method used, and corrective measures taken within 24 hours. The method used in the attack has not been disclosed at this stage, and Bitget stated it will not speculate on the attack vector until the investigation is complete.

    Why This Matters

    The Bitget incident highlights the persistent security challenges facing centralized cryptocurrency exchanges, particularly regarding hot wallet management. Hot wallets, which remain connected to the internet to facilitate rapid withdrawals and trading operations, represent a concentrated attack surface. The exchange’s three-layered architecture—segregating cold, warm, and hot wallets—demonstrates a defense-in-depth approach that successfully contained the breach to the most exposed layer. The existence of a substantial User Protection Fund, capitalized at over $464 million, reflects an industry trend toward self-insurance mechanisms that can absorb losses without requiring bailouts or socialized loss distribution among users. The temporary withdrawal suspension, while disruptive, follows standard incident response protocols to prevent further outflows during forensic analysis. The promised transparency—hourly updates and a detailed post-mortem within 24 hours—sets a benchmark for crisis communication in the digital asset sector. Regulators and industry observers will likely scrutinize the attack vector once disclosed, as it may inform evolving security standards for custodial platforms.

    Frequently Asked Questions

    Are user funds on Bitget safe after this incident?

    Yes. Bitget has confirmed that cold wallets were not affected and the approximately $351.6 million loss is fully covered by its User Protection Fund, which holds over $464 million in assets. Account balances remain accurate and user assets are protected.

    Can I still trade and deposit on Bitget?

    Yes. Deposits and trading continue as normal. Only withdrawal transactions have been temporarily suspended as a precautionary measure while the security review is conducted.

    When will withdrawals resume and when will we know how the attack happened?

    Bitget states withdrawals will reopen after the security review is complete. The company will provide hourly updates and publish a comprehensive incident report detailing the cause, method, and corrective measures within 24 hours of the initial detection.