Bitget Loses Rp5.8 Trillion in Hack, CEO Denies Private Key Leak

Cryptocurrency exchange Bitget had to absorb losses of up to US$351.6 million—equivalent to Rp5.8 trillion—after its systems were breached on 24 September 2026. The incident came to light when the platform detected unauthorized transfers from several hot wallets at 18:31 UTC, triggering widespread concern among digital market participants.

Bitget CEO Gracy Chen in an official statement on X asserted that private keys were not stolen. According to her, attackers infiltrated the backend system within the wallet infrastructure, falsified transaction data, and then triggered the authorization process to move funds. "Private key compromise has been ruled out," Chen wrote, adding that the intrusion method was still under intensive investigation.

The difference between an attack exploiting private keys and falsified transfers is highly significant. Private key hacks have long been the biggest cause of losses in the crypto industry because they allow attackers to keep signing new transfers undetected. Chen described the incident as a digital version of slipping a fake withdrawal slip to a bank teller: the vault key never left, but official documents were forged and sent through the same approval channel.

Chen detailed that the attack also touched the warm wallet layer—a semi-connected buffer between automated hot wallets and fully offline cold storage. This layer refills hot wallets when balances run low and pulls excess deposits off the internet. Nevertheless, Bitget's cold wallet was confirmed to remain safe. "User funds are safe. Your account balances are accurate and your assets are protected," she stressed.

"Loss containment has been confirmed. No further unauthorized transfers are possible. The system intrusion method is still under active investigation. A full technical report will follow once confirmed," said Gracy Chen.

Although the losses are covered by the protection fund, Bitget chose to suspend withdrawals as a precaution until the security audit is complete. Chen did not give a definite deadline for when withdrawals would reopen. "Several technical teams are working in parallel on system remediation and security hardening. We will announce the schedule once confirmed—we will not commit to a time window we cannot guarantee," she said.

The incident is a stark reminder for the global crypto industry, especially in the Asia-Pacific region, which is currently a testing ground for digital asset regulation. For Indonesian investors, the event highlights the importance of diversifying asset storage and choosing platforms with adequate protection funds. The Financial Services Authority (OJK), through crypto asset regulations in force since early 2025, emphasizes the need for strict risk management, including the separation of hot and cold wallets. However, this incident shows that even layered systems are vulnerable to exploitation of authorization gaps.

The domestic crypto market is expected to remain cautious. Trading volume on local exchanges such as Indodax and Pintu could be affected by short-term negative sentiment, although fundamentally there is no direct link to Bitget. Retail investors in Indonesia who store assets on global exchanges need to scrutinize the withdrawal policies and protection fund status of each platform.

Looking ahead, the big question: will Bitget release a full, transparent technical report, and will regulators in various jurisdictions tighten security audit standards for crypto exchanges? Without that clarity, market trust in the promise of "user funds are safe" could continue to be tested.