Major exchange hack triggers $464M protection fund

TLDR

Crypto exchange Bitget has confirmed a $351.6 million wallet hack but says its $464 million User Protection Fund will fully cover user losses.

1. Bitget reports unauthorized transfers from hot and warm wallets totaling about $351.6 million, with cold wallets and most assets unaffected.
2. The exchange says customer balances remain intact because its User Protection Fund holds over $464 million and user assets are backed one to one.
3. Withdrawals are paused pending a security review and full incident report, so users should watch for the timeline to reopen and for clearer attribution of the attackers.

Deep Dive

1. Scale Of Breach And Fund Coverage

Bitget detected abnormal transfers from parts of its hot and warm wallet infrastructure at 18:31 UTC on 24 Sep, ultimately estimating losses of roughly $351.6 million across several assets, including Ethereum, XRP, BNB, Avalanche, USDT and USDC as reported by multiple outlets.

The exchange and its CEO Gracy Chen state that all affected funds fall within the scope of Bitgets User Protection Fund, which currently holds more than $464 million, and that user account balances remain accurate and protected. Trading and deposits continue to operate, while withdrawals are temporarily suspended during the security review, according to notices summarized in reports from outlets like CryptoNews.

2. Custody Risk And Exchange Safeguards

Bitget describes a three tier wallet setup, with online hot wallets, intermediate warm wallets and offline cold wallets. The breach affected only the first two layers, while cold wallets holding the bulk of reserves were not touched, which is why the exchange can continue operating while it investigates.

Chen and subsequent technical summaries say the attackers did not steal private keys. Instead, they compromised a backend system tied to Bitgets wallet infrastructure, spoofed transaction data and used the exchanges own authorization process to push funds out, as detailed in coverage from CoinDesk. That highlights that even with large reserves and cold storage, centralized custody risk persists through internal systems.

3. Market Impact And What To Watch

Security firms and on chain analysts tie this incident into a broader 2026 trend of rising hack losses, with September now one of the costliest months for crypto theft, according to analysis cited by CryptoSlate. Bitget has engaged law enforcement and on chain security partners and says suspect addresses have been flagged.

Chen has suggested that North Korean linked actors are very likely involved, based on IP and pattern analysis, but has stopped short of definitive attribution while investigations continue. Bitget has promised a full incident report with root cause and corrective actions within roughly 24 hours of disclosure, and a separate announcement on when withdrawals will reopen.

Confidence: moderate because multiple independent news outlets quote consistent figures and technical details, while some attacker attribution remains preliminary.

Conclusion

Bitgets hack is large in dollar terms, but the immediate user impact is softened by a sizable dedicated protection fund and intact cold storage reserves. The episode is still a reminder that centralized exchanges combine technical and organizational attack surfaces, so the real risk question for users is not only how big are reserves but how robust are incident response, protection funds and transparency when something goes wrong. Watching how quickly Bitget restores withdrawals and publishes a credible post mortem will help gauge both venue risk and the markets tolerance for centralized custody after major breaches.