Major exchange suffers $351.6M crypto hack

TLDR

Crypto exchange Bitget has suffered an estimated 351.6 million dollar hot wallet breach, with withdrawals paused and its protection fund expected to cover customer losses.

1. Bitget detected unauthorized transfers on September 24 from parts of its hot and warm wallets, confirmed a 351.6 million dollar loss, and suspended withdrawals while trading and deposits continue.
2. The exchange says cold wallets and account balances are intact and that a 464 million dollar User Protection Fund will absorb the hit, limiting direct user loss.
3. Investigators see similarities to past North Korean hacks and are tracking large ETH conversions, making attribution, recovery progress, and Bitgets security changes the key things to watch.

Deep Dive

1. Scale And Status Of The Breach

Bitget reported that at 18:31 UTC on September 24 it detected unauthorized transfers from a limited number of hot wallets, later estimating the impact at about 351.6 million dollars in crypto assets. Withdrawals are frozen while the exchange runs a security review, but deposits and trading remain live and cold wallets were not affected, according to multiple notices and reports that confirm the breach and operational status.

Bitget states that the compromised amount is fully covered by its User Protection Fund, which holds more than 464 million dollars, and that user account balances remain accurate and visible in the interface. This framing treats the incident as a platform level loss that the exchange intends to absorb rather than a haircut for individual customers.

2. How The Attack Worked And Who May Be Behind It

Bitgets CEO Gracy Chen has said the attacker accessed internal systems and initiated transfers directly from hot and warm wallets rather than forging user withdrawal requests or stealing private keys, which suggests a systems compromise rather than a simple phishing incident.

Chen also disclosed that some related IP addresses and VPN choices match patterns seen in earlier North Korean operations, and that the attack resembles known DPRK linked campaigns, though attribution is still described as preliminary and unconfirmed in public statements. At the same time, onchain tracing shows the attacker converted most of the stolen EVM chain assets into about 67,982 ETH, roughly 183 million dollars, concentrating risk in a single large ETH position that market participants are now monitoring.

3. User Impact And What To Watch Next

For Bitget customers, the immediate constraint is withdrawal suspension despite assurances that balances and cold wallet assets are safe. The exchange has promised hourly updates and a full incident report with root cause and corrective actions, which will be important for judging how robust its future controls will be.

Externally, key signals include whether withdrawals resume quickly without further anomalies, how much of the stolen ETH and other assets can be frozen or recovered through venue cooperation, and whether regulators or security firms flag broader systemic lessons for other exchanges. A prolonged pause or vague remediation plan would increase concerns about operational risk and counterparty exposure.

Conclusion

This hack is one of the largest confirmed exchange breaches in 2026 and shows that even major platforms remain vulnerable when hot wallet and internal system security is compromised. Bitgets ability to cover losses from its protection fund may limit direct user damage, but trust will depend on transparent root cause analysis, concrete security upgrades, and clean resumption of withdrawals.

Confidence: high because multiple independent crypto news outlets and Bitgets own public notices report consistent figures, timelines, and technical details.