Introduction

The cryptocurrency exchange Bitget revealed on September 25, 2026, that approximately $351.6 million was lost after hackers gained unauthorized access to portions of its wallet infrastructure. The disclosure came amid heightened concerns over digital asset security and prompted the exchange to activate its emergency response protocols.

What Happened

According to official statements, security systems flagged unauthorized transfers from Bitget's hot wallets at 18:31 UTC on Thursday, September 24. The breach affected part of the exchange's hot and warm wallet layers, while cold storage holdings remained secure and untouched. Bitget acted quickly to suspend withdrawals as a precaution, though deposits and trading continued operating normally.

CEO Gracy Chen confirmed in a security notice that the incident was limited to certain wallet layers and that the exchange's cold storage remained fully protected. The company emphasized that user funds would be covered through its dedicated protection mechanism.

Why This Matters

The scale of the heist—nearly $351.6 million—highlights ongoing risks for users of centralized cryptocurrency platforms. Even with cold storage safeguards in place, compromise of hot wallet infrastructure can have immediate and significant financial impacts.

Bitget's disclosure that the attack pattern aligns with known North Korean hacking operations, based on IP behavior and on-chain analysis, adds a geopolitical dimension to the incident. The exchange's coordination with blockchain foundations to freeze associated addresses and its referral to law enforcement demonstrate the growing international response to crypto crime. Additionally, the incident underscores the importance of user protection funds in maintaining trust during security emergencies.

Key Takeaways

  • Approximately $351.6 million was stolen from Bitget's hot and warm wallet layers, with cold wallets confirmed secure and unaffected.
  • The exchange's User Protection Fund, holding over $464 million, will cover the full extent of the loss, ensuring user assets are protected.
  • Private key compromise has been ruled out, and no further unauthorized transfers are possible according to Bitget's latest update.
  • The attack methodology mirrors known North Korean hacking operations, prompting cooperation with global law enforcement and on-chain security firms.
  • Bitget Wallet, the exchange's decentralized wallet product, was not impacted by the breach and operates independently from the main platform.
  • Withdrawals remain suspended pending system remediation, though no specific timeline has been set until security hardening is complete.

Conclusion

As Bitget works toward releasing a full technical report and restoring normal operations, the incident serves as a critical case study in crypto exchange security, incident response, and the importance of user protection funds. Investors are advised to monitor official updates, consider diversifying storage across personal cold wallets, and stay informed about platform security measures. The broader takeaway is clear: robust backend security, real-time monitoring, and transparent communication remain the frontline defense against increasingly sophisticated digital threats.