Major exchange hack drains $351.6M in crypto

TLDR

Crypto exchange Bitget has suffered a $351.6 million hot wallet hack, paused withdrawals, and says user balances are covered by its protection fund while cold wallets remain secure.

1. Bitget reports unauthorized transfers of about $351.6 million from parts of its hot and warm wallet systems, with trading and deposits still live but withdrawals frozen.
2. The exchange claims its $464 million user protection fund fully covers the loss and that cold wallets and account balances are intact, limiting direct user losses if promises hold.
3. Investigators are probing a suspected backend compromise and possible North Korea link, with a full incident report and withdrawal reopening timeline as the key things to watch.

Deep Dive

1. Size, Scope And Current Status

Bitget says it detected unauthorized transfers at 18:31 UTC on 24 September involving parts of its hot and warm wallet infrastructure, totaling approximately $351.6 million in crypto. Trading and deposits continue, but withdrawals are suspended while a security review runs.

According to Bitget and multiple reports, cold wallets and most platform assets were not affected, and user account balances still show full holdings. Bitget states that its user protection fund holds over $464 million, enough in principle to cover the entire loss, and that some stolen funds have already been recovered from flagged attacker addresses.

TokenPost and other outlets report that attackers appear to have compromised a key backend system, used it to forge transaction data, and triggered internal authorization processes to move funds, while Bitget insists private keys for cold and hot wallets were not leaked and says no further unauthorized transfers are expected.

2. User And Market Impact

For Bitget users, the main short term impact is being unable to withdraw while investigations continue. If the protection fund and reserves are as described, users should ultimately be made whole, but they still face timing and counterparty risk.

This incident is one of the largest confirmed centralized exchange hacks in 2026, adding to a pattern of hot wallet compromises across the industry. Hot wallets are connected for operational convenience and therefore inherently more exposed than cold wallets, which remain offline.

Broader market contagion looks limited so far, since trading on Bitget continues and there is no sign of a systemic liquidity shock. However, confidence in centralized platforms, especially mid tier exchanges, can erode when nine figure breaches occur, which may shift some users toward larger venues or self custody.

3. Investigation, Attribution And Next Signals

Bitget has said it will publish a detailed incident report within about 24 hours of the hack, covering root cause and corrective measures, and will provide frequent updates on withdrawal status via its official channels.

CEO Gracy Chen has stated that preliminary technical evidence links some attacker IP addresses and VPN patterns to a North Korean hacking group, with similarities to earlier DPRK operations, but attribution remains unconfirmed and Bitget says it does not believe this was an insider job.

Key signals to monitor are: when withdrawals reopen, whether law enforcement or onchain security teams manage to freeze or claw back significant funds, and whether Bitget strengthens its architecture to reduce reliance on hot wallet infrastructure for large balances.

Confidence: moderate because multiple independent reports and Bitgets own statements align on size, scope and current status, while the exact attack vector and attacker identity are still under active investigation.

Conclusion

A $351.6 million hot wallet hack at Bitget underscores how centralized exchange infrastructure remains a major attack surface even when cold wallets stay intact and protection funds exist.

If Bitgets coverage and recovery plans perform as advertised, users may avoid permanent balance losses, but the episode reinforces that withdrawal risk and operational security sit at the core of centralized exchange exposure.