Bitget Hack: $351.6M Lost, Withdrawals Paused

Bitget suffered a $351.6M breach via a spoofed backend, not private keys. Withdrawals are paused, but user funds are safe and covered by a $464M protection fund.

Bitget, a top-10 exchange by trading volume, has disclosed a major security incident. On Sept. 24, 2026, unauthorized transfers totaling approximately $351.6 million were executed from its hot and warm wallet layers. The exchange's CEO, Gracy Chen, was quick to clarify that private keys were not compromised. Instead, attackers exploited a backend system to spoof transaction data and trigger the authorization process.

What happened in the Bitget hack?

The breach was detected at 18:31 UTC on Sept. 24, 2026. According to Chen, the attacker compromised a critical backend system within Bitget's wallet infrastructure. By spoofing transaction data, they tricked the system into authorizing transfers from the exchange's hot and warm wallets. The affected assets included Ether (ETH), XRP (XRP), USDt (USDT), USDC (USDC), Avalanche (AVAX), BNB (BNB), and USDT0 on Arbitrum. The networks involved were Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum, with Ethereum accounting for the largest concentration of stolen funds.

Early onchain reporting suggested around $183 million had moved, with Arkham Intelligence analyst Emmett Gallic initially citing $178 million across three hot wallets and one cold wallet. However, Chen later explained that the discrepancy arose because the incident extended beyond the Ethereum activity captured in early analysis. The final disclosed figure of $351.6 million reflects a broader scope.

Why it matters for Bitget users and the wider market

This event could be the largest crypto hack of 2026, potentially surpassing the $320 million lost by the Liquid Network earlier in September. For Bitget's users, the immediate concern is fund safety. Chen has stated that cold wallets remain fully secure and that user account balances are accurate and assets are protected. The exchange's User Protection Fund, which holds more than $464 million, will cover the full loss. This means users should not lose any funds as a result of the hack, assuming the fund is deployed as promised.

Withdrawals were temporarily suspended as a precautionary measure, but deposits and trading remain open. Chen expects withdrawals to reopen in a matter of hours or days, though she also noted that Bitget will not commit to a timeline it cannot guarantee. The exchange has flagged addresses associated with the transfers and contacted law enforcement and onchain security firms. Hourly updates are promised, with a full incident report due within 24 hours.

Market reaction to the Bitget hack

The market reaction has been relatively contained so far. Bitget's native token BGB fell sharply after news broke, down 2.9% at press time, but had recovered somewhat by 22:10 UTC. In the broader market, Bitcoin was down 0.29% and Ether down 0.2% over the past 24 hours. On our exchange, Ethereum is priced at $2,685.58, down 0.11% in the last 24 hours, while XRP is at $1.57, up 3.26%. Avalanche is trading at $10.32, down 1.08%, and BNB is at $773.11, down 1.10%. USDT remains stable at $0.999771, up 0.01%.

The muted reaction in major assets suggests that traders are not treating this as a systemic event. However, BGB's drop highlights the direct impact on the exchange's own token. If withdrawals remain paused for long, it could pressure BGB further, but a swift reopening and clear communication could restore confidence.

What to watch next

Several key developments will determine the aftermath of this Bitget hack:

Withdrawal resumption: Chen's expectation of hours or days will be tested. A prolonged pause could erode trust.
Incident report: The full technical report within 24 hours will reveal the exact attack vector and remediation steps.
User Protection Fund deployment: Confirmation that the $464 million fund is used to cover losses will be crucial for user confidence.
Onchain movement: Tracking the flagged addresses may lead to recovery or identify the attackers.
Regulatory response: Given Bitget's Seychelles registration, international cooperation may be limited.

For now, the situation remains fluid. Bitget's handling of the next 24 to 48 hours will be critical in shaping its reputation and the broader market's perception of exchange security.

FAQ

What is the Bitget hack?

The Bitget hack refers to unauthorized transfers totaling approximately $351.6 million from Bitget's hot and warm wallets on Sept. 24, 2026. Attackers compromised a backend system to spoof transactions, not private keys.

Why did Bitget suspend withdrawals?

Bitget temporarily suspended withdrawals as a precautionary measure while it reviewed security. Deposits and trading remained open. The exchange expects to resume withdrawals within hours or days.

Is my money safe on Bitget?

According to CEO Gracy Chen, user funds are safe. Cold wallets are secure, account balances are accurate, and the $464 million User Protection Fund covers the full loss. However, withdrawals are paused, so access to funds may be delayed.

Market snapshot

Prices at the time of writing (Sep 25, 2026 14:30 UTC).

Ethereum (ETH): $2,685.58 — 24h -0.11%
XRP (XRP): $1.57 — 24h +3.26%
USDT (USDT): $0.999771 — 24h +0.01%
Avalanche (AVAX): $10.32 — 24h -1.08%
BNB (BNB): $773.11 — 24h -1.10%

Trade ETH now →

Bitget Hack: $351.6M Lost, Withdrawals Paused—What Now?