Bitget confirmed on Sept. 24, 2026 that unauthorized transfers drained roughly $351.6 million from parts of its hot and warm wallet infrastructure, an incident the Asia-focused exchange says is covered by its User Protection Fund. According to Cointelegraph, the breach estimate is nearly double the initial figures circulating onchain.
Founder and CEO Gracy Chen said the exchange detected the unauthorized transfers at 18:31 UTC that day and that cold wallets were untouched. Bitget has temporarily suspended withdrawals, though deposits and trading remain operational. Coverage of the incident appeared in both Cointelegraph and News.bitcoin.
Also read: Japan's FSA urges crypto exchanges to impose withdrawal delays to combat scams
Key facts
- Bitget estimates approximately $351.6 million was affected by unauthorized transfers on Sept. 24, 2026, detected at 18:31 UTC.
- Chen said the breach was contained to portions of Bitget’s hot and warm wallet layers within its three-tier architecture, and that cold wallets remain secure.
- The exchange’s User Protection Fund holds more than $464 million, which Bitget says covers the full estimated loss, with user account balances remaining accurate.
- Withdrawals are paused during a security review while deposits and trading continue; Bitget said it has flagged the addresses involved and notified law enforcement and onchain security firms.
- Bitget pledged a complete incident report, including root cause and corrective measures, within 24 hours, plus hourly updates through official channels.
How the figure grew during the day
News.bitcoin reported that blockchain security researchers first flagged large multi-chain movements from Bitget-labeled addresses on Thursday, with social estimates starting near $174 million and climbing toward $183 million as more transactions surfaced. Bitget’s confirmed figure of about $351.6 million is nearly twice that early tally. Security firms Hacken and PeckShield had drawn attention to the suspicious wallet activity before any official confirmation existed, and the exchange has said it will not speculate about the attack vector while its investigation proceeds.
Why it matters
Withdrawals are the lifeline of any exchange, so pausing them is a costly step even when a protection fund absorbs the loss. The larger effect is on confidence: users of a centralized venue cannot verify wallet security themselves, so the operational detail Bitget releases — hot and warm layers affected, cold storage intact, balances accurate — becomes the main evidence that funds are safe. The size of the affected amount places this among the largest confirmed exchange security incidents of 2026, and the exchange’s promise of a root-cause report within a day sets a short deadline for the transparency that follows.
Also read: Z.ai confirms it’s the lab behind Ox Alpha, the open-weight model topping AI leaderboards
What to watch
The full incident report promised within 24 hours, which should name the root cause and corrective measures. Also watch when the exchange lifts its withdrawal pause, and whether law enforcement or onchain investigation identifies the addresses Bitget has already flagged.
Reported by cointelegraph.com.
Sources: Cointelegraph, News.bitcoin
