- Published on
Crypto exchange Bitget says $352 million affected in a hack, claims user funds are 'safe'
- Authors
- Name
- DeepHorus
Crypto exchange Bitget said on September 24 that a system breach had exposed $351.6 million of its assets, potentially making it one of the year’s largest cybersecurity incidents. CEO Gracy Chen announced the incident on X shortly after independent researchers flagged unusual wallet movements. According to Bitget, the unauthorized activity involved transfers from some hot wallets, while cold wallets and user funds remained safe. Deposits and trading stayed online, but the exchange temporarily paused withdrawals to conduct a security review.
Bitget described the incident as a limited compromise of its three-tier wallet architecture, which separates hot, warm and cold storage. Hot wallets remain connected to systems used for transactions and withdrawals, making them more exposed than isolated cold wallets. The exchange also cited a user protection fund holding more than $464 million as an additional safeguard for customers. That reserve provides financial backing, but the announcement did not explain the attack’s entry point, the precise scope of customer exposure or whether reimbursement would be necessary.
Blockchain analytics firm Arkham Intelligence initially tracked roughly $178 million to $183 million moving from wallets labeled as Bitget’s, before the exchange disclosed its larger exposure figure. Analyst Emmett Gallic said the transactions involved three Bitget hot wallets and one cold wallet across multiple blockchains. The assets, including ETH, BNB, AVAX and USDT0, were consolidated into a single address. Researchers noted that additional transfers continued as they refined their estimates, making the earlier figures preliminary rather than a final assessment.
If losses reach the full $351.6 million, the breach could rank among 2026’s largest exchange hacks, though the amount described as exposed is not necessarily the same as money permanently stolen. The incident follows Liquid Network’s reported $320 million loss earlier in September, which the attackers described as white-hat activity. By comparison, Bitget’s event presents a more direct risk of unauthorized asset transfers and operational disruption. Keeping withdrawals online in affected systems could increase exposure, while freezing withdrawals may protect remaining assets but inconvenience customers.
Market traders reacted cautiously after the disclosure. Bitget’s BGB token fell sharply as the reports spread, then recovered part of its decline and was down 2.9% at 22:10 UTC, according to the supplied market data. Over the same 24-hour period, Bitcoin slipped about 0.29% and ether about 0.2%. The relatively modest moves in major assets contrasted with BGB’s more direct sensitivity to the exchange’s reputation and financial position.
Reactions have focused on the contrast between a substantial potential loss and the exchange’s assurance that customers’ funds are secure. The user protection fund’s size could absorb some corporate losses, but its existence alone does not prove that every user withdrawal will be available on schedule. Suspending withdrawals gives Bitget time to investigate wallet permissions, transaction histories and any still-active attacker addresses. It also gives researchers more onchain evidence to compare with the company’s internal findings.
Bitget has promised to publish an incident report within 24 hours, a step that could clarify how attackers bypassed security controls and whether the figure changes. The report should address wallet-signing procedures, the involvement of the cold wallet observed by researchers and the disposition of the transferred assets. Users will likely watch for restored withdrawals, any evidence of customer reimbursement and a firmer explanation of the protection fund’s role. For the broader market, the episode reinforces the continuing need to limit hot-wallet exposure, isolate transaction signing and verify unusual movements before losses spread.
