Bitget Pauses Withdrawals After $351.6M Wallet Breach, Says Protection Fund Covers Losses

Bitget, a Seychelles-registered cryptocurrency exchange ranking among the world’s top platforms by trading volume, has confirmed that intruders siphoned an estimated $351.6 million in digital assets from portions of its hot and warm wallet infrastructure on September 24, 2026. Should the figure hold, this would rank as the largest confirmed exchange breach of the year so far.

The exchange has frozen all withdrawals while keeping deposits and trading active, and CEO Gracy Chen has stated that customer balances remain accurate and that Bitget’s dedicated reserve fund will absorb the shortfall in full.

What Bitget Has Confirmed So Far

Bitget’s internal security systems flagged unauthorized transfers at 18:31 UTC on September 24, according to a notice Chen posted on X roughly three hours later. The same statement was mirrored on Bitget’s support portal.

[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026

At 18:31 UTC on September 24, 2026, Bitget’s security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately.

What we have…

— Gracy Chen @Bitget (@GracyBitget) September 24, 2026

The exchange differences customer holdings across three tiers: hot wallets that stay internet-connected for fast withdrawal processing, warm wallets that refill those hot wallets under tighter controls, and cold wallets kept entirely offline holding the bulk of reserves.

Chen claimed that the intrusion had affected only specific parts of the hot and warm layers, leaving cold storage untouched. Bitget stated that it had immediately initiated emergency procedures and flagged all the addresses that received the stolen funds, notifying the police and blockchain forensic firms and providing hourly updates and a comprehensive root-cause analysis within 24 hours.

How The Breach Actually Happened

Chen initially avoided speculating on the attack vector, but a follow-up post roughly six hours later traced the intrusion to a compromised backend system within Bitget’s wallet infrastructure. Attackers reportedly spoofed transaction data that then passed through the exchange’s standard authorization pipeline.

Here is what we can confirm at this stage:

On the attack:
Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization… https://t.co/5nINjwbXpC

— Gracy Chen @Bitget (@GracyBitget) September 25, 2026

Chen ruled out a private key compromise, explaining that the vulnerability sat in the internal system instructing wallets what to sign, not in the cryptographic keys themselves, making this closer to a signing-pipeline breach than a conventional key theft.

This account has an early crease worth noting: shortly after the hack surfaced, Arkham Intelligence analyst Emmett Gallic reported that the exploit had touched three Bitget hot wallets and one cold wallet, with stolen funds funneled into a single joined address.

That initial read stands somewhat at odds with Bitget’s later insistence that cold storage was never cooperated, and it’s not yet clear whether Arkham’s early wallet-tagging was reviewed as more data came in.

Separately, Chinese-language coverage of a Bitget livestream cited Chen attributing the entry point to a compromised third-party operational tool, though Bitget’s own written statements have not confirmed that detail.

Tracing Where The Stolen Funds Went

Initial on-chain estimates significantly understated the damage. Early wallet-tracker tools reported between $170 million and $192 million in funds moved out of Bitget-branded wallets, with crypto analytics firm Bubblemaps detecting 15 transfers worth an estimated $192 million involving seven different assets in total.

This figure is nearly double the amount transferred on-chain according to slowmist’s MistTrack tracking tool, which is designed to detect cross-chain attacks and illicit activity, that found seven addresses owning more than 102 million XRP (worth $12.63 million) which had been largely unaccounted for by most Ethereum-focused tracking tools.

Bitget(@bitget) was hacked for ~$351.6M!🚨

The hacker has already swapped most of the stolen funds on EVM chains for 67,982 $ETH($183M).https://t.co/KkILPI2RNU pic.twitter.com/TgCE0OUi13

— Lookonchain (@lookonchain) September 24, 2026

Lookonchain subsequently published a nine-asset tally worth an estimated $356.86 million, closely matching Bitget’s internal figure of $351.6 million in value spanning 19 different transactions, which involved Ethereum, XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum

Attackers generated a new wallet, deposited $19.67 million in USDT0, and utilized decentralized exchange liquidity to purchase 7,111 ETH by paying approximately 5% more than the prevailing market price to do so. This shows that there was urgency in turning easily seizable,freezable stablecoins into Ethereum, an asset that has no central issuer who can claw back the funds.

Chen confirmed during a livestream that the bulk of stolen stablecoins and related tokens were converted into approximately $170 million worth of ETH for exactly this reason. Blockchain explorer Etherscan has since labeled one receiving cluster “Bitget Exploiter 1.”

Who Bitget Believes Carried Out The Attack

During a live Q&A, Chen said investigators had traced IP addresses that fit the pattern of a VPN used by North Korean state-sponsored hackers, and that the attack pattern bore similarities to previous intrusions attributed to the same group. She stressed Bitget does not believe this was an inside job, while acknowledging the attribution remains preliminary rather than confirmed.

Earlier 7 hours ago, I hosted a live stream with everyone that lasted over three hours. Here’s a summary of the points I covered in the live:

① Bitget security incident update — 1 hours in. We’re sharing specific facts, not just reassurances.

② Affected assets include ETH,… https://t.co/kkVr4YbKZq

— Gracy Chen @Bitget (@GracyBitget) September 25, 2026

On-chain researcher Specter separately argued the fund flows overlap with an earlier theft cluster connected to the Lazarus Group, the North Korean unit blamed for numerous major crypto heists including February 2025’s Bybit hack. Bitget has not verified that specific link, leaving the North Korea attribution as an early CEO-level assessment rather than a completed forensic conclusion.

Can Bitget’s Protection Fund Absorb The Loss?

Bitget established its User Protection Fund back in 2022 with an initial $300 million commitment, designed as a corporate reserve to compensate users following extreme events like hacks. Chen said the fund held more than $464 million at the time of disclosure. A $351.6 million payout would consume roughly 76% of that pool, leaving around $112 million in reserve, assuming full liquidity.

Chen also pointed to Bitget holding over $1 billion in its own capital, drawing a comparison to Bybit’s decision to absorb a $1.5 billion loss in February 2025 and continue operating uninterrupted. Bitget’s August 2026 protection fund report showed an average valuation near $382 million and roughly 5,500 BTC held within the pool, meaning much of the fund’s dollar value fluctuates alongside Bitcoin’s price.

This fund is a separate mechanism from Bitget’s Proof of Reserves, a periodic solvency snapshot; its September update reported a 135% aggregate reserve ratio, though that figure measures solvency at a single point in time and doesn’t speak to whether the protection fund itself has ever been independently audited.

Market Reaction & Ongoing Fallout

Bitget’s native token BGB fell suddenly as news broke, though it had partially recovered by late evening UTC, ending the trading window down roughly 2.9%. Bitcoin and Ether both saw uncertain declines of under half a percent over the same 24-hour stretch, suggesting the broader market captivated the news without severe contagion.

Aneirin Flynn, CEO of cybersecurity firm FailSafe, told Bloomberg the breach undermines any illusion that major exchanges have solved hot-wallet security, adding that even a fully covered loss of this scale damages institutional confidence in crypto infrastructure largely.

Xie Jiayin, Bitget’s head of Greater China, said the exchange has brought in an independent third-party security team to conduct forensic review, with withdrawals set to resume only once all identified risks are cleared. Bitget Wallet, the company’s separate self-custody app, confirmed it was unaffected by the exchange-side breach.

A Rough Month For Crypto Security

This incident adds to an already costly September for the industry. Earlier this month, around $320 million worth of bitcoin was withdrawn from the address linked to the liquid network which attackers controversially called white hat hackers.

On the other hand, crypto casino Duelbits has confirmed a cybersecurity breach that drained approximately $7 million from its hot wallets, forcing the platform offline while investigators establish the attack’s root cause. Co-founder Joe disclosed the incident on X, assured customers that user funds remain safe, and said operations would resume after the investigation and wallet replenishment are completed.

Confirming a ~$7M hack. Still investigating exactly what happened and how.

Until we have clarity, Duelbits stays offline. User funds are safe.

Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.

I’ll keep posting… https://t.co/V4Zl4St31I

— Joe (@DuelbitsJoe) September 24, 2026

Combined industry tallies suggest September’s reported crypto thefts have now pushed past $684 million, surpassing April’s $646.9 million total driven by the Drift and KelpDAO exploits. Bitget was already contending with a separate incident this same week, having paused FET token deposits after the SingularityNET bridge exploit widened in scope.

The exchange, which ranked as roughly the sixth-largest platform by trading volume near the time of the breach, is also in the process of winding down its operations in Japan by the end of the year. Even at $351.6 million, this breach remains considerably smaller than the Bybit theft of February 2025, still the largest exchange hack on record.

Where Things Currently Stand

As of the latest update, Bitget reports account balances as accurate, deposits and both spot and derivatives trading remain open, cold wallets are unaffected per the company’s own account, law enforcement and blockchain security firms have been notified, and a full incident report is due imminently.

Chen has said withdrawals will stay paused until the compromised backend pathway is fully secured, warning that reopening prematurely could expose the exchange to a second loss, though she indicated restoration should take hours or days rather than weeks.

Users are advised to treat only the official @GracyBitget and @bitget accounts as verified channels and to disregard any unofficial “emergency withdrawal” links, a common phishing tactic that tends to surface in the aftermath of major exchange hacks.

What Comes Next

Three developments will determine how this incident is ultimately judged: the confirmed timeline for reopening withdrawals, a complete asset-by-asset accounting of any recovered or frozen funds, and whether independent security researchers corroborate the North Korea attribution beyond Bitget’s own preliminary assessment.

The forthcoming root-cause report is expected to be the first document to address these questions on the record, and this remains very much a developing story as Bitget continues publishing updates and independent researchers keep tracing the stolen funds across chains.

Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV

You need to login in order to Like