Cryptocurrency exchange Bitget has disclosed that approximately $351.6m was lost after hackers gained unauthorised access to part of its wallet infrastructure.

The exchange said its security systems detected unauthorised transfers from some of its hot wallets at 18:31 UTC on Thursday, September 24, prompting it to activate its emergency response protocols.

In an initial security notice signed by Bitget CEO, Gracy Chen on Thursday, the exchange said the breach was limited to part of its hot and warm wallet layers, while its cold wallets remained secure.

“Estimated funds affected: approximately $351.6 million,” Bitget said.

The exchange said withdrawals were temporarily suspended as a precaution, while deposits and trading remained operational.

It also assured users that the loss was covered by its User Protection Fund, which it said held more than $464m.

“User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million,” Bitget said.

In a subsequent update, Chen disclosed more details about how the attackers moved the funds, saying they had compromised a critical backend system within Bitget’s wallet infrastructure.

“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” she said.

Chen said the investigation had ruled out a compromise of private keys and that further unauthorised transfers had been prevented.

“Private key compromise has been ruled out, this excludes the more severe risk scenarios. Loss containment is confirmed. No further unauthorized transfers are possible,” she said.

However, Bitget said the specific method used to gain access to the backend system remained under investigation, with a full technical report to be released once the findings were confirmed.

The exchange later disclosed that the affected assets included ETH, XRP, BNB, AVAX, USDT, USDC and other tokens across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base networks.

“All on-chain cold wallets have been confirmed secure and unaffected,” Chen said during a livestream with users.

She also said Bitget had contacted the foundations of the affected blockchain networks, with some confirming the freezing of wallet addresses linked to the attackers.

On the possible identity of the attackers, Chen said Bitget’s analysis had found similarities with known North Korean hacking operations.

“Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations,” she said.

She added that the exchange had reported the matter to relevant institutions and was cooperating with a global investigation.

Chen also clarified that Bitget Wallet, the exchange’s decentralised wallet product, was not affected by the incident.

“Bitget Wallet operates completely independently from Bitget exchange infrastructure, and this incident has no impact on it whatsoever,” she said.

On the restoration of withdrawals, Bitget said several technical teams were working on system remediation and security hardening, but that it would not announce a timeframe until one was confirmed.

“Our goal is to complete a full recovery as soon as possible. We will announce the specific time window immediately upon confirmation. We will not commit to timelines we cannot deliver on,” Chen said.

Bitget said it had also notified law enforcement agencies and on-chain security firms and was pursuing available channels to contain the incident and recover the affected assets.

The exchange had earlier said it would provide hourly updates and publish a full incident report, including its root-cause analysis and corrective actions, within 24 hours.