Overview
- Bitget’s security systems flagged unauthorized transfers from a subset of hot and warm wallets at 18:31 UTC on Thursday, Sept. 24, and the exchange immediately suspended withdrawals while leaving deposits and trading open.
- The company’s preliminary forensics say attackers spoofed a core backend wallet‑service to produce legitimate‑looking approval data rather than stealing private keys, allowing multi‑chain outflows that were later halted.
- On‑chain trackers and Bitget’s own updates put the haul between about $351.6 million and $387.5 million, with roughly 102.93 million XRP and about 31,890 ETH among the largest components.
- Bitget has engaged Mandiant, SlowMist and law enforcement, says some attacker addresses have been frozen or partially recovered, and plans to cover customer losses from a User Protection Fund it values at more than $464 million.
- The incident highlights a growing threat from backend infrastructure compromises, raises questions about custodial risk and protection‑fund resilience, and could shape how exchanges manage hot‑wallet operations and disclosure going forward.