Crypto exchange Bitget lost approximately $351.6 million after attackers compromised a backend system inside its wallet infrastructure and used it to spoof transaction data, tricking the exchange’s own authorization process into approving transfers it should have rejected.

What happened

According to Bitget’s own security notice, the exchange detected unauthorized transfers from a limited number of hot wallets at 18:31 UTC on September 24. The notice states the breach “contained only a portion of the hot wallet and warm wallet layers,” and that Bitget’s cold wallets, holding the large majority of platform assets, were never touched. Bitget says the attackers did not obtain the private keys controlling its wallets; instead, a compromised backend system falsified transaction data well enough to pass Bitget’s own internal approval checks. The exchange paused withdrawals as a precaution while it runs a security review, and says its User Protection Fund, over $464 million, will cover the full loss. Deposits and trading continued operating normally.

Why it matters

Most exchange-hack post-mortems center on stolen private keys or compromised signing infrastructure. This one does not. Bitget’s own account describes attackers reaching the authorization layer that decides whether a transfer is legitimate, not the cryptographic layer that moves funds, and using that access to make fraudulent requests look approved, a fundamentally different control to defend and audit.

The insight

Exchanges have spent years hardening private-key custody, cold storage, multi-signature schemes, precisely because key theft was the dominant failure mode. An attacker who can spoof the data an approval system trusts does not need any of that hardened custody to fail; they only need the pipeline to believe a fraudulent request is real. That mirrors a pattern CyberTech has tracked in adjacent contexts, from malware distributed through fake crypto-wallet apps to financially motivated intrusions with no direct crypto exposure: attackers increasingly target the systems that make trust decisions, not just the assets those decisions protect. Any enterprise running an internal approval pipeline should treat its integrity, not just its access controls, as its own attack surface.

Source: Bitget