Key points

  • Bitget CEO Gracy Chen said the exchange detected unauthorized transfers from some hot wallets at 18:31 UTC on September 24.
  • Bitget put the affected amount at about $351.6 million and temporarily suspended withdrawals while deposits and trading remained available.
  • The exchange said cold wallets and customer funds were secure and that its protection fund could cover the loss, but those claims remain subject to verification.

Cryptocurrency exchange Bitget has temporarily suspended withdrawals after reporting unauthorized transfers from part of its hot-wallet infrastructure, with about $351.6 million affected. Chief executive Gracy Chen said Bitget's security systems detected the activity at 18:31 UTC on September 24 and activated emergency-response procedures.

What Bitget disclosed

Chen's security notice said cold wallets remained secure and described the breach as limited to part of the exchange's hot and warm wallet layers. Bitget kept deposits and trading available but paused withdrawals while it conducted a security review. The company said it had identified and flagged relevant transfer addresses, contacted law enforcement and brought in blockchain-security firms. It also promised a fuller incident report within 24 hours.

Related reporting: Revolut disclosed Bitcoin records after fake government request

Bitget said customer funds were safe and that the loss fell within the coverage of its User Protection Fund, which Chen valued at more than $464 million. Those statements are the exchange's account while the investigation remains active. The company has not yet disclosed the attack vector, identified the responsible party or provided an independently audited accounting of the affected assets.

Onchain transfers preceded the notice

Independent researchers began flagging large transfers from Bitget-labelled wallets before the exchange's public notice. The Block initially identified more than $170 million moving to a new address across assets including ether, USDT, USDC, AVAX and BNB, with the receiver swapping assets onchain. CoinDesk reported an initial estimate of roughly $183 million based on labelled-wallet activity. Bitget's later $351.6 million figure covered a wider set of affected funds across multiple networks.

Forbes matched the first test transfer to 18:31 UTC and reported that additional movements continued before the notice was issued at about 21:30 UTC. Public blockchain records can show the timing, assets and destination addresses of transfers, but they do not by themselves establish how access was obtained or whether every labelled wallet was controlled by the attacker. Bitget said it would not speculate about the method until its investigation was complete.

What customers should watch

The immediate operational question is when withdrawals will resume and whether Bitget's protection arrangements cover any customer shortfall. A temporary withdrawal pause can prevent further losses during an investigation, but it also limits customers' ability to move assets off the platform. Bitget had not announced a reopening time when this article was verified.

Users should rely on Bitget's official website and verified social accounts for service updates and should be cautious of unsolicited recovery messages, fake support accounts and lookalike wallet addresses. The incident has already attracted spoofed onchain activity designed to resemble transfers associated with the breach, according to Forbes. No legitimate exchange investigation requires customers to share seed phrases or private keys.

The scale makes this a significant test of Bitget's security controls, incident response and protection-fund claims. The promised report will be important for establishing which systems were compromised, how the unauthorized transfers were authorized, the final net loss after any asset recovery and the timetable for restoring withdrawals. Until those details are published and independently checked, the $351.6 million total and the assurance that users will be made whole should be treated as Bitget's preliminary account.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.