Bitget, a Seychelles-registered centralized crypto exchange founded in 2018, reported roughly $351.6 million in unauthorized transfers from portions of its wallets. Posting on X early Friday in Singapore, Chief Executive Gracy Chen said "User funds are safe," noting the hit is fully covered by Bitget's User Protection Fund, which "currently holds over $464 million."
Chen explained the company uses a three-tier wallet design and that the breach was limited to parts of the hot and warm layers, with cold storage intact. In initial details on the method, she said attackers "compromised a critical backend system" and "used it to spoof transaction data." In a livestream on X, she said the company suspects North Korea. She also identified stolen assets including Ether, XRP, BNB, AVAX, USDT and USDC.
"Deposits and trading remain fully operational," Chen said, adding "Withdrawals are temporarily paused and will be restored as soon as the security review is complete." She said a full incident report with root cause and corrective actions will be released within 24 hours. Blockchain analytics platform Lookonchain estimated roughly $183 million of the pilfered assets were converted into Ether. Chen also said several chain foundations are locking the hackers' wallet addresses so the money cannot be swapped out.
Bitget says its protection fund will absorb the loss. The exchange's website cites 120 million registered users, and the platform grew following the 2022 collapse of FTX as trading migrated to venues that remained operational.
Unexpected disruptions remind investors that steady protections matter more than short term noise. Join Briefs Finance CEO Jaspreet Singh on September 29th for a FREE live investor workshop, How to Profit From A Dollar That's Losing its Value, where he shows how we're spotting investment opportunities as the dollar falls. Save your spot.
At blockchain security firm CertiK, Esme Pau, who leads capital markets and policy, called it "one of the most substantive centralized exchange exploits of 2026" and "another wake-up call for the digital-assets industry," adding, "The scale of the drain at around three quarters of the exchange's User Protection Fund transcends a security lapse and makes it a crisis event."
Aneirin Flynn, CEO at the cybersecurity technology company FailSafe, said the takeaway "is that it destroys the illusion that major exchanges have solved hot-wallet security." He added, "Even though their protection fund covers the loss, a breach of this size severely damages institutional trust in crypto infrastructure."
This comes amid a run of high profile attacks. Earlier this month, roughly $320 million in Bitcoin was taken from a wallet associated with Liquid Network, and in August a breach involving the popular offline Bitcoin wallet Coldcard rekindled debate on the safest way to store digital assets.
Functionally, Bitget says trading and deposits are normal, while withdrawals are paused until the security review wraps. A detailed postmortem is due within 24 hours. If you keep assets on Bitget, watch for updates on when withdrawals resume and whether efforts to freeze the thieves' addresses stop further swaps.
Keeping a clear plan helps preserve and grow your savings through uncertain times. Our CEO Jaspreet Singh is hosting a FREE live investor workshop, How to Profit From A Dollar That's Losing its Value, on September 29th. Sign up free to join him live.
