Major exchange halts withdrawals after $351M breach

TLDR

Crypto exchange Bitget has suspended withdrawals after a roughly $351.6 million breach in its hot and warm wallet systems.

1. Bitget reports about $351.6 million was drained from hot and warm wallets, while cold wallets and user balances remain covered by a protection fund.
2. Deposits and trading stay live, but the incident highlights ongoing risks of centralized custody despite large stated reserves.
3. Withdrawals are paused pending a security review and incident report, with early but unconfirmed signs pointing to a sophisticated backend compromise and possible North Korea links.

Deep Dive

1. What Happened And Whats Confirmed

Multiple reports say Bitget detected unauthorized transfers from a limited set of hot and warm wallets at 18:31 UTC on 24 Sep, with losses estimated around $351.6 million. Bitget states that its User Protection Fund holds more than $464 million, enough to fully cover the affected assets and keep customer account balances accurate and protected, while cold wallets remained untouched and most platform assets are secure. Trading and deposits continue, but withdrawals were halted as part of emergency protocols, and the exchange has flagged the attacker addresses and notified law enforcement and on chain security firms.

2. Impact On Users And The Broader Market

For Bitget users, the immediate issue is access, not balance: funds are reported as accounted for, but withdrawals are frozen until the security review and repairs are complete. At market level, the breach is one of the largest exchange incidents of 2026, pushing Septembers total crypto thefts to a yearly high according to industry tracking of hacks and exploits. That reinforces a structural lesson that even well capitalized venues with proof of reserves and protection funds cannot eliminate operational or backend risks.

3. Attack Vector, Attribution, And What To Watch

Bitget says private keys were not compromised; instead, attackers exploited a backend wallet infrastructure system, spoofed transaction data, and triggered Bitgets own authorization flow to move funds. On chain analysts and Bitgets CEO have suggested strong similarities with past North Korea linked Lazarus Group attacks, citing VPN and IP patterns, but they stop short of definitive attribution while investigations continue. Key next signals are Bitgets promised incident report, any timeline for restoring withdrawals, and whether investigators recover or freeze parts of the stolen funds across networks like Ethereum, BNB Smart Chain, XRP, Arbitrum, Optimism, Base, and Avalanche.

Conclusion

Bitgets breach shows that even large exchanges with dedicated protection funds remain exposed to sophisticated backend attacks, though robust reserves can cushion users from direct balance losses. Until withdrawals reopen and the root cause is fully documented, this incident will stay a live test of Bitgets security, transparency, and crisis handling, and a broader reminder that custody choice is a core part of crypto risk management.