Bitget Confirms $351.6 Million Stolen From Hot Wallets, Suspends Withdrawals

Bitget got hit. The crypto exchange confirmed a $351.6 million hot-wallet breach on Thursday, September 24, 2026, and suspended withdrawals while it investigates.

How it played out

On-chain sleuths spotted the trouble hours before Bitget said a word. A pseudonymous analyst who goes by DCF GOD flagged the first red flag on X: a freshly created wallet beginning with "0xe410" bought 7,111 ETH on the Arbitrum network in six minutes, spending roughly $19.67 million in USDT0 pulled from what looked like a Bitget hot wallet. The buyer used UniswapX and 1inch Fusion, decentralized trading tools that let someone swap assets without a middleman, and paid up to 5% above market price to get it done fast, according to Crypto Briefing and Decrypt.

That kind of overpaying is a tell. Analysts at Bubblemaps and Arkham picked up the trail next, tracking roughly $170 million to $183 million in ETH, USDT, USDC, BNB, AVAX and even the gold-backed token XAUT moving from four wallets (three hot and one cold) into a single unmarked address, according to BigGo Finance and CryptoRank. That address then splintered the funds further, according to Bubblemaps.

At that point Bitget still hadn't said anything publicly. Then, at 6:31 p.m. UTC, Bitget's own security systems detected unauthorized transfers, according to a company statement posted on X. Bitget said it activated emergency response protocols and later put the total damage at $351.6 million, more than double the early on-chain estimates, according to Bloomingbit.

What Bitget says happened

CEO Gracy Chen posted that the exchange's cold wallets, the offline reserves not connected to the internet, are "fully secure." The breach hit only part of the hot and warm wallet layers, the ones exchanges use to process everyday withdrawals fast. Chen said user account balances are intact and deposits and trading are running normally. Withdrawals, however, are paused for additional security checks.

Chen said the full loss falls within Bitget's User Protection Fund, which she says currently holds more than $464 million, meaning the exchange claims it can make users whole without touching customer deposits. Bitget also said it has identified the addresses tied to the abnormal transfers, is tracking them, and has shared details with law enforcement and outside blockchain security firms, according to Bloomingbit.

An exchange that catches a breach fast, isolates it to hot wallets, keeps cold storage intact, and has a nine-figure insurance fund sitting ready is not the same as an exchange that gets wiped out. Bitget moved quickly and put numbers on the table instead of stonewalling.

What's still unconfirmed

BigGo Finance reported "unconfirmed claims" pointing to possible North Korean involvement, a reference to the Lazarus Group, which U.S. officials have tied to past exchange hacks. No government agency, law enforcement source, or Bitget statement in these reports names North Korea or any specific attacker. This remains speculation in the crypto commentary world, not an established fact.

The attack vector itself is also unknown. Bitget said it would "refrain from speculating on the specific attack vector while the investigation is ongoing," according to Bloomingbit. Whether this was a compromised private key, a phishing attack on an employee, a supply-chain exploit, or something else entirely has not been determined.

The bigger picture

This is a crypto exchange holding customer assets in centralized wallets, and those wallets got drained for over $350 million by someone who is still anonymous. That's the exact risk the "not your keys, not your coins" crowd has been warning about for a decade. Bitget's insurance fund may cover it this time. The next exchange might not have $464 million sitting around.

Bitget said withdrawals will resume once the security review is complete. No timeline has been given. Until then, customers with funds on the platform can watch their balances but can't touch them, and the identity of whoever pulled off the theft remains an open question.