Bitget has suspended withdrawals after attackers moved $351.6 million out of the exchange's hot and warm wallets. The company said its security systems flagged multiple unauthorized transfers, that further outflows were stopped, and that offline cold storage was not affected. Deposits and trading remain open while the investigation continues.

Chief executive Gracy Chen said private keys were not compromised. Instead, the attacker gained access to a backend system within Bitget's wallet infrastructure, used it to spoof transaction data, and triggered the exchange's own authorization process. Chen said the company has linked the activity to North Korean IP addresses.

Bitget is working with law enforcement, Mandiant, and SlowMist, and Chen said some wallets holding the stolen funds have been frozen. The company said its User Protection Fund, which holds 5,500 BTC valued at more than $464 million, will cover the full loss, and that the separate Bitget Wallet product was unaffected.

No date has been set for withdrawals to resume. Chen said it could take hours or days but should not take weeks. The incident is one of the largest exchange breaches of the year, and the sequence of the review, the reopening of withdrawals, and any recovery will determine its lasting effect.