Bitget Hot Wallet Incident Affects $351.6M, Withdrawals Paused

Bitget says unauthorized transfers affected portions of its hot and warm wallet infrastructure. Meanwhile, withdrawals remain suspended during a security investigation.

SINGAPORE, MemeBlock, Cryptocurrency exchange Bitget confirmed that its security systems detected unauthorized transfers from some hot wallets at 18:31 UTC on September 24, 2026. The exchange estimated that approximately $351.6 million in assets were affected.

The exchange said the incident was limited to portions of its hot and warm wallet layers, and that its cold wallets remained secure. Furthermore, Bitget also said customer account balances were not altered. It further noted that its User Protection Fund, which it said held more than $464 million, was sufficient to cover the affected amount.

Withdrawals were temporarily suspended after the incident, while deposits and trading remained operational, according to Bitget’s official security notice.

Bitget Confirms Unauthorized Wallet Transfers

The Bitget hot wallet incident was first visible through blockchain activity before the exchange publicly confirmed the security event.

Bitget said its security systems detected the unauthorized transfers at 18:31 UTC. Its emergency response team was activated within minutes. Additionally, the company said abnormal transfer addresses had been identified and reported. Law enforcement agencies and on-chain security firms had also been notified.

The exchange did not initially identify the technical method used to gain access. Its official notice said Bitget would not speculate about the attack vector while its investigation continued.

That distinction is important because early blockchain monitoring produced a lower figure than Bitget’s internal estimate.

The Block reported that more than $170 million had moved from wallets labeled as belonging to Bitget into a newly created address before the exchange confirmed the incident. Meanwhile, Decrypt later reported that on-chain activity had shown roughly $183 million in assets moving from Bitget-labeled wallets across several networks.

Those figures represented visible blockchain movements rather than Bitget’s final internal assessment of affected assets.

Blockchain Activity Preceded The Official Confirmation

Early on-chain analysis identified transfers involving assets including ETH, USDT, USDC, AVAX and BNB.

Decrypt reported that a newly created wallet used approximately $19.67 million in USDT0 to acquire about 7,111 ETH on Arbitrum over roughly six minutes. The transactions reportedly routed through UniswapX and 1inch Fusion.

The reported blockchain activity provided an early indication that the transfers were not ordinary exchange-wallet movements. However, wallet labels and attribution should be treated carefully until independently confirmed.

The Block initially reported that the receiving address had begun swapping assets after receiving funds. The outlet noted that it was unclear at that stage whether the transfers represented a compromise or an internal Bitget operation.

That uncertainty changed after Bitget issued its security notice confirming unauthorized transfers.

Bitget has not publicly identified a specific attacker in its official incident notice. Additionally, the company has not published a complete transaction-by-transaction accounting of the $351.6 million estimate in the material reviewed for this report.

Why the Difference Between $183M and $351.6M Matters

The gap between early public blockchain estimates and Bitget’s $351.6 million figure is one of the most important details for readers following the incident.

Blockchain analytics can measure assets transferred from addresses that have been labeled as belonging to an exchange. However, an exchange’s internal loss calculation can include assets across additional wallets, networks, asset types or valuation periods that are not immediately visible from a single receiving address.

For that reason, the early figures reported by blockchain analysts should not be treated as competing estimates of the same measurement. This caveat applies without knowing the methodology behind each figure.

Bitget’s $351.6 million number is currently the company’s stated estimate of affected funds. The roughly $170 million to $183 million figures reported during the initial phase describe publicly observed transfers.

The distinction also explains why the final incident report will matter. Bitget said it would publish a report covering the root cause and corrective actions.

Withdrawals Remain Suspended During the Investigation

Bitget separately published a withdrawal suspension notice confirming that withdrawals were unavailable while deposits and trading remained operational.

The exchange said withdrawals would be restored after the security review was completed. It did not provide a fixed reopening time in the notice.

Bitget also said its User Protection Fund held more than $464 million, compared with its estimated $351.6 million exposure. On the company’s stated figures, the fund was approximately $112.4 million larger than the reported affected amount.

That calculation does not establish how or when any recovery or reimbursement would occur. It only compares the two figures disclosed by Bitget.

The exchange said customer account balances remained accurate and that user assets were protected. Those statements are Bitget’s own representations and should be distinguished from an independently audited assessment of the incident.

Attack Path and Remaining Questions

The precise attack path remained an open issue in Bitget’s official security notice.

Subsequent reporting citing CEO Gracy Chen’s comments described a possible compromise involving internal wallet infrastructure and transfer-authorization processes rather than a straightforward private-key theft. TokenPost reported that Chen said 19 transfers were involved. The investigation had not established the root cause.

A separate report from Bloomberg? No, that claim is not included here because the available reporting reviewed for this article did not provide an independently verifiable Bloomberg account.

The lack of a completed primary-source postmortem means claims about a supply-chain attack, compromised third-party software or manipulation of transaction information should not yet be presented as established facts.

For readers and exchanges, the central questions are now whether all affected wallets have been isolated. Furthermore, are additional unauthorized transfers still possible? How much of the affected crypto can be recovered? Another question is how Bitget will substantiate its $351.6 million calculation.

Bitget said it had engaged law enforcement and blockchain-security firms and would provide further updates through its official channels.

The next major verification point is the exchange’s promised full incident report, including its root-cause analysis and corrective measures. That report should allow the industry to reconcile the public blockchain movements with Bitget’s broader $351.6 million assessment.