TLDR
Crypto exchange Bitget has suffered a major security breach involving about $351.6 million in digital assets, but it says user balances are fully covered and cold wallets are intact.
- Bitget detected unauthorized transfers from hot and warm wallets totaling roughly $351.6 million and paused withdrawals while keeping trading and deposits live, backed by a $464 million protection fund.
- Attackers reportedly compromised a backend wallet system, spoofed transaction data, and moved funds across several chains, with early evidence pointing to North Korean-linked hackers, though attribution is not yet confirmed.
- Users should watch for Bitgets promised incident report, withdrawal resumption, and possible copycat attacks, as the breach underscores ongoing risks around centralized custody even when losses are insured.
Confidence: high, based on consistent exchange statements and multiple independent reports.
Deep Dive
1. Scale Of The Loss And User Impact
Bitget says abnormal transfers were detected at 18:31 UTC on 24 Sep from parts of its hot and warm wallet infrastructure, with the affected sum later estimated at about $351.6 million.Bitget confirms breach
Cold wallets, which hold the bulk of reserves, are reported as secure, and the loss falls within Bitgets User Protection Fund, which holds over $464 million.security notice
Withdrawals are temporarily suspended while the security review runs, but deposits and trading remain operational, and Bitget states that customer account balances are accurate.Daily incident summary
Direct balance haircuts are unlikely if Bitgets fund is real and liquid, but withdrawal suspension is a practical risk for any user needing access.
2. How The Attack Worked And Who Is Suspected
Bitget and media reports say private keys were not stolen; instead, attackers infiltrated a backend wallet system, manipulated transaction data, and tricked Bitgets own authorization process into signing transfers.technical description
Funds were moved across multiple networks, including Ethereum, XRP Ledger, BNB Chain, Avalanche, Arbitrum and others, before being consolidated and swapped, notably into tens of thousands of ETH that are harder to freeze.multi-chain analysis
CEO Gracy Chen and several reports cite IP and VPN patterns similar to past North Korean operations, suggesting Lazarus Group involvement, but all stress that this attribution remains preliminary and unconfirmed.CNBC coverage
Even without key theft, sophisticated backend exploits can drain large centralized pools, and state-linked actors remain a major threat vector.
3. Broader Risk And What To Watch Next
Bitget has promised a full incident report with root-cause analysis and corrective actions within roughly 24 hours of disclosure, plus hourly updates as the investigation proceeds.exchange update
Other major venues are already reacting; for example, Binance has highlighted new wallet-side protections against high-risk signatures in the wake of this breach, stressing user vigilance around approvals.security update context
If Bitget restores withdrawals smoothly and documents robust fixes, market impact may stay contained; a prolonged freeze, regulatory pushback, or evidence of wider compromise could amplify distrust of centralized custody.
For any exchange, the real risk is less price slippage and more operational lock-in; users should diversify custody and monitor official security communications.
Conclusion
The Bitget incident is one of 2026s largest confirmed exchange hacks and shows that even well-capitalized platforms with insurance can face sudden operational shocks. The immediate takeaway is that hot- and warm-wallet infrastructure, not just private keys, are critical failure points. How quickly Bitget restores withdrawals and how clearly it explains the exploit will shape both user confidence in that venue and the wider narrative around centralized exchange risk in the coming weeks.
CoinsKid.Com