Crypto exchange Bitget confirmed a $351.6 million security breach after attackers gained unauthorized access to hot wallets and moved assets across blockchain networks, converting stablecoins into Ethereum.
CEO Gracy Chen said the unauthorized transfers were detected at 18:31 UTC on September 24. The company immediately limited withdrawals and activated emergency protocols. Cold wallets remained secure throughout the incident, and Chen stated that user funds are safe, with Bitget's protection fund covering the entire reported loss.
How the Attack Unfolded
On-chain researchers observed unusual transfers from Bitget-linked wallets, initially detecting approximately $183 million before the full loss was revealed. A newly created wallet received $19.67 million in USDT, which was then used to purchase 7,111 ETH through decentralized trading services at approximately 5% above the prevailing market price.
The rapid conversion to Ethereum was designed to shift the stablecoins into an asset that cannot be frozen by token issuers. Additional transfers included ETH, USDT, USDC, AVAX, BNB, and tokenized gold to multiple addresses, with funds traced across multiple blockchain networks.
Response and Investigation
Bitget temporarily suspended withdrawals while its security team investigated the affected wallet systems. Deposits and trading continued operating during the review. The exchange identified suspicious addresses and alerted law enforcement and blockchain security firms.
The company's protection fund currently holds more than $464 million. Bitget stated account balances remain accurate and said it would release frequent updates and a full incident report detailing the attack method and planned security improvements. The exact breach method has not yet been disclosed.
