Cryptocurrency exchange Bitget suffered a $351.6 million loss after attackers exploited a compromised wallet backend to spoof transaction data, rather than stealing private keys outright, CEO Gray Chen said in a statement posted to X.
How the Attack Unfolded
According to Chen, the breach did not involve the theft of private keys, which are typically the primary target in exchange hacks. Instead, attackers managed to compromise a portion of the exchange's wallet backend infrastructure and manipulate transaction data.
By spoofing the information that governs how transfers are processed, the perpetrators were able to redirect funds without directly accessing the cryptographic keys that secure user wallets. The distinction matters because it points to a vulnerability in the exchange's internal systems rather than a failure of its core key management.
The attackers didn't steal the keys — they tricked the system into moving the money.
The Scale and Response
The reported loss of $351.6 million places the incident among the more significant exchange breaches in recent memory. Chen used the platform X to address the community and clarify the nature of the exploit, aiming to distinguish it from the private-key compromises that have plagued the industry.
Exchanges have increasingly hardened their private-key storage through cold wallets and multi-signature setups, which may explain why sophisticated attackers are shifting toward backend and transaction-layer manipulation.
Key points from Chen's statement include:
- The total loss reached $351.6 million
- Private keys were not compromised in the breach
- Attackers exploited a wallet backend to spoof transaction data
What It Means for Users
Incidents like this underscore that securing digital assets involves far more than protecting cryptographic keys. The integrity of the surrounding infrastructure — including the systems that validate and execute transfers — remains a critical point of exposure.
For Bitget users and the broader market, the details Chen shared will likely fuel scrutiny over how exchanges safeguard the full lifecycle of a transaction. The company has not yet detailed its recovery plans or whether affected funds will be reimbursed.