Major exchange hack prompts $464M protection fund

TLDR

Crypto exchange Bitget suffered a roughly $351.6 million wallet hack and is using its $464 million protection fund to fully cover user losses while withdrawals remain paused.

1. Hackers drained about $351.6 million from Bitgets hot and warm wallets via spoofed transfers, but cold wallets and private keys are reportedly untouched.
2. Bitget says its User Protection Fund holds over $464 million and will absorb the entire loss, keeping customer balances intact despite frozen withdrawals.
3. The breach adds to a wave of large, often state-linked crypto hacks, and users should watch for Bitgets incident report and withdrawal restart timeline.

Deep Dive

1. What Happened At Bitget

Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure at 18:31 UTC on 24 Sep, ultimately estimating the loss at about $351.6 million. Multiple reports confirm this figure and note that trading and deposits remain live while withdrawals are suspended for a security review, with cold wallets unaffected and user balances still accurate.

According to Bitget and independent coverage, attackers compromised a backend system tied to the wallet infrastructure, manipulated transaction data, and triggered Bitgets own authorization process rather than stealing private keys, which the exchange says have not been compromised. This places the failure in internal systems and controls rather than in user accounts or offline reserves.

2. How The $464M Fund Protects Users

Bitget maintains a User Protection Fund that it says holds more than $464 million, positioned specifically to cover exchange-side incidents like this hack. Current reports state that the entire $351.6 million shortfall falls within this funds coverage, so customer account balances remain unchanged and losses are effectively socialized to the exchanges reserves rather than users.

At the same time, withdrawals are paused until the security review and remediation are complete, which means users may not be able to move funds off the platform even though their balances are credited. Some hacker addresses have reportedly been frozen after coordination with affected networks, and Bitget has promised a detailed incident report and clearer withdrawal timeline once investigations conclude.

3. Broader Security Implications

Preliminary evidence, including IP patterns and attack similarities, has led Bitgets CEO and several analysts to suggest North Korea-linked hacking groups may be behind the breach, though attribution is not yet formally confirmed. This fits into a broader trend of large state-linked crypto thefts and underscores that centralized exchanges remain high-value targets.

For the wider market, this hack pushes monthly crypto losses to new highs for 2026 and reinforces that large protection funds and proof-of-reserves dashboards do not eliminate platform risk. The key signals to watch now are Bitgets promised technical report, its timeline for reinstating withdrawals, and any follow-on regulatory or industry changes around exchange security and insurance-like reserves.

Conclusion

Bitgets hack shows that even large, well-capitalized exchanges can suffer nine-figure breaches, but a sizable protection fund can prevent direct user balance losses. The tradeoff is operational risk while withdrawals are frozen and lingering uncertainty until the attack vector and fixes are fully disclosed. For crypto users, the incident is a reminder to diversify custody, pay attention to exchange security practices, and follow official communications closely when major breaches occur.