Major Exchange halts withdrawals after $351M hack

TLDR

Crypto exchange Bitget has frozen withdrawals after a roughly $351.6 million hack targeting its hot and warm wallets, while saying its user protection fund fully covers the loss.

1. Bitget detected unauthorized transfers totaling around $351.6 million on 24 Sep and suspended withdrawals, though trading and deposits continue.
2. The stolen assets span XRP, ETH, stablecoins and others, but Bitget claims cold wallets and user account balances remain intact and covered by a $464M+ protection fund.
3. Investigations point to a backend system breach with possible North Korean links, and users should watch for the incident report, withdrawal restart and broader exchange security fallout.

Deep Dive

1. What Happened At Bitget

Bitget reported that its security systems flagged abnormal transfers from parts of its hot and warm wallet infrastructure at 18:31 UTC on 24 Sep, with losses estimated at about $351.6 million in digital assets, prompting an immediate halt to withdrawals and activation of emergency protocols. The exchange says the affected amount is fully within its User Protection Fund, which reportedly holds more than $464 million, and that trading and deposits remain live, with user balances accurate in unaffected cold wallets, according to multiple notices including a Bitget security breach confirmation.

Bitgets CEO Gracy Chen has emphasized that private keys were not compromised; instead, attackers appear to have exploited a backend wallet infrastructure system, spoofing transaction data and triggering Bitgets own authorization process to move funds off platform, as described in a Bitget wallet hack summary.

2. User Impact And Market Risk

On-chain analysis indicates the hack drained a mix of assets, with XRP reportedly the largest single hit at over 100 million tokens, alongside ETH, USDT, USDC, BNB, AVAX, TRX, tokenized gold and others, per an overview of how XRP suffered the biggest hit. While Bitget insists its protection fund will make users whole, withdrawals remaining paused means customers cannot currently move funds out, which is the most immediate practical risk.

At the market level, this breach adds to a cluster of 2026 exploits, pushing Septembers crypto theft total to a yearly high and keeping centralized custody risk firmly in focus, as highlighted in analysis of September crypto losses at a 2026 high. The incident may temporarily weigh on confidence in centralized exchanges and encourage greater scrutiny of their wallet architectures and proof-of-reserves claims.

3. Investigation And What To Watch Next

Bitget has commissioned internal and third party forensic teams, saying attackers breached systems rather than keys and that no further unauthorized transfers have been detected, as detailed in a backend breach probe update. Chen has called North Korean hacker involvement very likely, based on IP and VPN patterns, but attribution remains unconfirmed while the investigation continues.

The exchange has promised a full incident report with root-cause analysis and corrective measures, and separately indicated it would outline a withdrawal recovery plan while withdrawals stay suspended, according to an update that keeps withdrawals suspended pending a recovery plan. Key signals to watch are: the publication of the technical report, concrete timelines for withdrawal resumption, and any regulatory or industry responses that could tighten standards across exchanges.

Conclusion

Bitgets $351.6 million hack is large, but the exchanges claim that its protection fund fully covers user balances reduces direct insolvency risk while leaving a significant short term access and trust problem. The breach reinforces that centralized exchanges remain attractive targets and that even without private key loss, backend and process exploits can be costly. For crypto users, monitoring official updates, diversifying custody and paying attention to how venues harden their infrastructure after events like this are key to managing ongoing exchange risk.