Major exchange suffers $351.6M crypto hack

TLDR

Crypto exchange Bitget has suffered a roughly $351.6 million security breach affecting its hot and warm wallets, with withdrawals paused but losses reportedly covered by its user protection fund.

1. Bitget reports unauthorized transfers of about $351.6 million from a limited set of hot and warm wallets, while cold wallets and account balances remain intact.
2. The stolen assets span major coins and stablecoins, but Bitget says its $464 million protection fund fully covers the loss, and trading and deposits continue.
3. Investigators are probing a possible North Korean link and the exact attack vector, while users must wait for withdrawals to resume and a promised incident report.

Deep Dive

1. What Happened In The Hack

Bitget disclosed that on 24 Sep it detected unauthorized transfers from portions of its hot and warm wallet infrastructure, with an estimated loss of about $351.6 million in crypto assets, prompting emergency protocols and a withdrawal halt. According to a detailed update, only a limited number of hot wallets were affected; cold wallets, which hold the bulk of reserves, remain secure, and user account balances are unchanged, with trading and deposits still live on the platform. Public reporting from multiple outlets, including a summary of Bitgets $351M security breach, confirms the scale of the theft and the current pause on withdrawals while a security review is underway.

2. Impact On Users And Markets

Onchain analysis shows the attacker drained a basket of assets, including large amounts of ETH, XRP, USDT, USDC, BNB, AVAX and TRX, with much of the EVM side converted into tens of thousands of ETH worth around $180 million. Bitgets CEO Gracy Chen has emphasized that the entire affected amount sits within the exchanges User Protection Fund, which reportedly holds over $464 million, meaning users should not take a direct balance hit even though they temporarily cannot withdraw. Given the size of the hack, it ranks among the largest exchange incidents of 2026, but the combination of cold wallet isolation and a pre funded insurance pool has so far limited contagion to other venues.

3. Attribution And What To Watch Next

Chen has said preliminary technical evidence, including IP addresses and VPN patterns, resembles previous attacks linked to a North Korean group, and several reports note this possible DPRK connection, though attribution is not confirmed yet. Coverage such as Bitget CEO suspects North Korea behind $352M hack stresses that investigators still do not know exactly which internal systems were compromised or how access was gained. Bitget has promised hourly updates and a full incident report with root cause and corrective measures, and the key milestones for users are the publication of that report, any recovery of stolen funds, and the timeline for safely reopening withdrawals.

Confidence: high for loss size and user coverage, moderate for attacker identity due to still ongoing investigation.

Conclusion

Bitgets hack shows that even large, seemingly well prepared exchanges remain vulnerable at their hot wallet layer, but a sizable protection fund and cold wallet segregation can blunt direct user losses. The main practical implications are a temporary liquidity shock for Bitget users and another reminder to diversify custody and monitor exchange security posture, especially around how much of your assets sit in online wallets at any one time.