Bitget Investigates $351M Breach as Withdrawals Remain Suspended

The incident, detected at 18:31 UTC, bypassed standard withdrawal protocols by injecting false transfer data directly into the exchange’s approval-signature process. Despite the scale of the theft, Bitget maintains that its cold storage layers were unaffected. The company’s internal User Protection Fund, which holds over $464 million, is positioned to cover the losses, and the exchange insists that individual account balances remain accurate.

On-chain analysts at Lookonchain suggest the total haul may be higher than internal estimates, with 102.93 million XRP—valued at roughly $157.48 million—making up the largest portion of the stolen assets. Other significant outflows included 31,890 ETH and various stablecoins. While CEO Gracy Chen noted that preliminary evidence suggests the use of VPN patterns consistent with North Korean hacking groups, she stopped short of a formal attribution, noting that investigations into the specific entry point are ongoing.

Bitget has kept trading and deposit services active while engineering teams work to strengthen security controls. No timeline for the restoration of withdrawals has been provided, though the exchange has committed to publishing a comprehensive root-cause analysis. For now, the focus remains on coordinating with law enforcement and blockchain partners to track the movement of the pilfered funds.