Bitget says $352M Exposed in Hot-Wallet Hack, User Funds 'safe'

Bitget had $351.6 million exposed to a system breach on Thursday, CEO Gracy Chen said in a post on X. Withdrawals are paused; deposits and trading remain live.

Chen said cold wallets and user funds were safe. The exchange's three-tier wallet architecture was hit only in part: a portion of the hot-wallet layer and the warm-wallet layer, the semi-connected buffer between automated hot wallets and fully offline cold storage. "Cold wallets remain fully secure," Chen wrote. "User funds are safe. Your account balances are accurate and your assets are protected."

Bitget's User Protection Fund holds more than $464 million, Chen said, enough to cover the full loss. The breach surfaced at 18:31 UTC on Sept. 24, when Bitget's systems flagged unauthorized transfers from some exchange hot wallets. Chen promised a full incident report within 24 hours.

How the attacker got in

Chen later said the attacker compromised a critical backend system within Bitget's wallet infrastructure, used it to spoof transaction data, and triggered the exchange's authorization process to move funds out. "Private key compromise has been ruled out," she wrote. The specific method of intrusion remains under active investigation. Loss containment is confirmed, and no further unauthorized transfers are possible, Chen said.

What on-chain researchers saw

Before Chen's post, on-chain data and independent researchers had flagged roughly $183 million in unusual movements from wallets labeled as belonging to the exchange. Emmett Gallic, an analyst at blockchain analytics firm Arkham Intelligence, posted on X that the transactions involved three Bitget hot wallets and one cold wallet across multiple blockchains, with the funds consolidated into a single address. The assets included ETH, BNB, AVAX and USDT0. Gallic initially put the figure at $178 million.

Gallic's post named one cold wallet among the four addresses involved. Bitget has said cold wallets were untouched. The discrepancy has not been addressed in the exchange's public statements.

The Missing Pieces

• The $351.6 million loss figure is the CEO's estimate, not an on-chain total.
• The promised 24-hour incident report is not confirmed as published.
• The attacker's identity, and where the consolidated funds now sit, are unknown.
• Whether the $464 million User Protection Fund is enough to cover the loss rests on Bitget's own claim.

Bitget's native token BGB was down 2.9% as of 22:10 UTC on Sept. 24, while bitcoin was down about 0.29% and ether down 0.2% over the prior 24 hours. The breach comes after the Liquid Network lost $320 million earlier this month in a separate hack. If the $351.6 million figure holds, it would rank as possibly the largest crypto exchange hack of 2026.