Bitget will cover an estimated $351.6 million loss from its User Protection Fund after attackers moved assets out of part of its hot and warm wallet infrastructure on September 24, 2026. Withdrawals remain suspended during a security review. Industry trackers describe it as the largest breach of a centralized exchange reported so far this year.
The exchange’s monitoring systems flagged the unauthorized transfers at 18:31 UTC. By the next day, CEO Gracy Chen said the attackers had compromised a backend system inside the wallet infrastructure. They used it to spoof transaction data and trigger Bitget’s own authorization process. She said no private keys were stolen.
Trading and deposits continue as normal. Bitget has not given a date for reopening withdrawals. Chen has promised a full incident report with a root-cause analysis and a list of corrective actions.
What Is Confirmed and What Is Still Preliminary
This is a developing story. The status of each key detail as of September 25, 2026:
| Detail | What has been said | Status |
|---|---|---|
| Estimated loss | About $351.6 million | Confirmed by Bitget |
| Detection time | 18:31 UTC, September 24 | Confirmed by Bitget |
| Cold wallets | Not affected | Company statement |
| Attack method | Compromised backend system spoofed transfer data; private keys not exposed | CEO statement; full report pending |
| Assets moved | ETH, XRP, USDT, USDC, AVAX, BNB | Reported by media and on-chain observers; no official breakdown |
| Number of transfers | 19 | Reported by CNBC |
| Suspected attacker | North Korean hackers | CEO suspicion based on IP clues; unconfirmed |
| Withdrawals reopen | No date given | Pending |
How the Attack Reportedly Worked
According to Chen, the attackers did not need to steal signing keys. They took control of a system that feeds requests into the signing process, so forged transfers passed through the exchange’s normal approval flow. If the root-cause report confirms this, customers should take note. A breach that abuses legitimate authorization is harder to catch than outright key theft, and its fix lies in internal controls rather than key rotation alone.
Chen has also said early evidence, including IP address clues, points toward North Korean hackers. Neither Bitget nor law enforcement has confirmed that attribution.
Why the First Estimates Were Lower
On-chain observers initially put the outflow at roughly $174 million to $183 million. Bitget later said those early calculations missed activity on some affected networks. The transfers reportedly spanned Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum. More than $170 million in assets were reportedly swapped into ETH during the attack, a step that often precedes efforts to move and obscure stolen funds.
Can the Protection Fund Absorb the Loss?
Bitget’s User Protection Fund holds more than $464 million, according to the company. That leaves a buffer of about $112.4 million above the estimated exposure. Some coverage notes the fund is denominated in Bitcoin, so its dollar value rises and falls with BTC’s price. The exchange also reportedly holds over $1 billion in proprietary capital.
Bitget says customer balances are accurate and user assets are safe. Outside verification is still limited. The exchange has not yet published affected wallet addresses, transaction hashes, a full asset breakdown, or a detailed timeline of the transfers.
What Customers Can Do Right Now
The current rules are simple: trading and deposits are open, and withdrawals are paused. Chen said the exchange will post hourly updates through official channels. On a reopening date, she said Bitget “will not commit to a window we cannot guarantee.”
Why Withdrawals Are Frozen
Pausing outbound transfers is standard after a suspected wallet compromise. It blocks further unauthorized movements and preserves evidence for blockchain analysts. It also gives security teams time to check signing systems, privileged access, API activity, and address allowlists. The trade-off is that users cannot move funds during a volatile stretch.
Bitget has notified law enforcement, flagged the destination addresses, and brought in on-chain security firms. That work typically involves tracing cross-chain hops, mixer usage, and attempts to cash out through other exchanges.
How Bitget’s Custody Tiers Work
Bitget uses a three-tier model. Hot wallets are internet-connected and handle routine deposits and withdrawals, which makes them frequent targets. Warm wallets sit between hot wallets and offline cold storage and hold limited operational liquidity. Cold wallets keep the bulk of reserves offline. The company says this breach did not reach the cold tier.
Staying Safe From Follow-On Scams
Hacks often bring a wave of phishing. Users should rely only on Bitget’s verified website and official social accounts. They should ignore unsolicited “compensation” offers and never share passwords, recovery codes, API keys, or wallet details.
A Costly Month for Crypto Security
The breach follows a loss of roughly $320 million at Liquid Network earlier this month, which makes September 2026 the costliest month for crypto hacks this year. It also revives memories of the February 2025 Bybit hack, which U.S. authorities attributed to North Korean operatives and which remains the largest exchange theft on record.
