Gracie Chen held a live stream on X and revealed details of the incident. The amount involved has been fixed at $351.6 million and is no longer increasing. All 19 transfers made by the hacker originated from hot and warm wallets; cold wallets have not been affected.
The root cause of the hack remains unidentified. What is known so far: the hacker did not forge user withdrawal requests, did not obtain private keys, but rather gained access to Bitget’s corporate systems and carried out the transfers from there. This is precisely why withdrawals have been suspended—there is a risk that resuming withdrawals before the investigation is complete could lead to even greater losses.
In terms of its nature, this attack differs from the Bybit hack: it involved more networks and types of coins. The largest single theft was XRP worth over $100 million. Part of the stolen funds, including USDT, USDC, and other tokens, has already been converted into ETH, totaling approximately $170 million.
Preliminary data points to North Korean hackers; investigators found IP addresses matching VPN services used by one of North Korea’s hacking groups. Some of the stolen funds have been recovered, though the exact amount has not been disclosed. Withdrawals for users will resume within a timeframe ranging from several hours to several days—but definitely not weeks.