Scope

Security

Avalanche

USDT0

Crypto exchange <a rel="noopener noreferrer nofollow" href="https://partner.bitget.com/bg/cryptobreaking">Bitget</a> says it has detected an unauthorized transfer event that affected approximately $351.6 million worth of assets, and it has temporarily suspended withdrawals while it investigates. The incident was identified after <a rel="noopener noreferrer nofollow" href="https://partner.bitget.com/bg/cryptobreaking">Bitget</a>’s security systems flagged suspicious activity involving a limited set of hot wallets around 18:31 UTC on Thursday.
In a live Q&amp;A, Bitget CEO Gracy Chen said the breach was contained to a portion of the exchange’s hot and warm wallet infrastructure, while its cold wallets remained secure. She also indicated that withdrawals are expected to restart within hours to days, and that the exchange is working with law enforcement and onchain security firms.
<h2 id="key-takeaways">Key takeaways</h2>
<ul>
 <li>Bitget reported unauthorized transfers totaling about $351.6 million and temporarily halted withdrawals.</li>
 <li>The company says only a limited number of hot wallets were involved, with cold wallets remaining secure.</li>
 <li>Chen cited exposure across multiple networks, with <a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/ethereum/">Ethereum</a> representing the largest concentration of the observed stolen funds.</li>
 <li>Bitget said customer balances remain accurate and deposits and trading continue.</li>
 <li>Bitget claims the losses are more than covered by its User Protection Fund, which it says holds over $464 million.</li>
</ul>
<h2 id="what-bitget-says-happened">What Bitget says happened</h2>
According to Bitget’s public statement, its security monitoring systems identified unauthorized transfers linked to a small number of hot wallets at 18:31 UTC on Thursday. The exchange then initiated emergency response procedures.
Chen said the incident was confined to certain hot and warm wallet layers. She emphasized that Bitget’s cold wallet setup—typically used to hold the majority of assets offline—was not compromised. This distinction matters because it suggests the attack vector likely targeted operational wallet components rather than Bitget’s offline reserves.
<h2 id="scope-of-affected-assets-and-networks">Scope of affected assets and networks</h2>
Chen said affected assets included <a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/ethereum/">Ether</a> (<a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/ethereum/">ETH</a>), <a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/ripple/">XRP</a> (<a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/ripple/">XRP</a>), USDt (USDT), USDC (USDC), <a rel="noopener noreferrer nofollow" href="https://med.etoro.com/B10215_A127826_TClick_Scb-avalanche.aspx?TargetURL=https://www.etoro.com/markets/avax">Avalanche</a> (<a rel="noopener noreferrer nofollow" href="https://med.etoro.com/B10215_A127826_TClick_Scb-avalanche.aspx?TargetURL=https://www.etoro.com/markets/avax">AVAX</a>), <a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/binance-coin/">BNB</a> (<a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/binance-coin/">BNB</a>), and USDT0 (USDT0) on Arbitrum. She also identified the networks involved as <a rel="noopener noreferrer nofollow" href="https://coinstats.app/coins/ethereum/">Ethereum</a>, the XRP <a rel="noopener noreferrer nofollow" href="https://ledger.pxf.io/gO5AdA">Ledger</a>, <a rel="noopener noreferrer nofollow" href="https://med.etoro.com/B10215_A127826_TClick_Scb-avalanche.aspx?TargetURL=https://www.etoro.com/markets/avax">Avalanche</a>, BNB Smart Chain, and Arbitrum.
While Bitget disclosed multiple tokens and multiple networks, Chen pointed to Ethereum as accounting for the main concentration of the observed stolen funds. That detail is important for market participants and onchain analysts because it indicates where investigators may find the clearest trail of movement first—particularly when early reporting is based on initial onchain sightings.
Bitget also addressed a discrepancy between early onchain reporting and its later figure. Chen said the initial estimate appeared lower because the unauthorized activity extended beyond the Ethereum-focused activity captured in early onchain analysis.
<h2 id="withdrawal-suspension-and-ongoing-operations">Withdrawal suspension and ongoing operations</h2>
Bitget temporarily suspended withdrawals during its security review. Chen said the exchange expects withdrawals to resume within a matter of hours or days, implying a staged restoration process rather than an immediate return to full throughput.
At the same time, Bitget stated that user account balances remain accurate and that deposits and trading are continuing normally. For users, that combination—trading functionality intact but withdrawals paused—signals that Bitget likely prioritized liquidity protection and operational controls while it determines how funds moved and what portion can be recovered or compensated.
Bitget said it flagged addresses associated with the transfers and that it had contacted law enforcement and onchain security firms. Those steps typically aim to both support forensic tracing and reduce the likelihood of further movement through blacklisted or monitored pathways.
<h2 id="compensation-stance-and-promised-reporting">Compensation stance and promised reporting</h2>
Chen said the affected funds are more than covered by Bitget’s User Protection Fund, which she said currently holds more than $464 million. The claim is meant to reassure users that the exchange has a buffer to compensate for losses, even though the final outcome—such as whether any portion is recovered—still depends on the investigation.
Bitget also said it will provide hourly updates and publish a full incident report within 24 hours. The report is expected to include a root-cause analysis and corrective actions, which investors and system auditors will likely focus on to understand how the breach reached hot and warm wallet layers and what controls will be revised to prevent recurrence.
The exchange’s approach—rapid operational containment, public disclosure of token and network scope, and a defined timeline for deeper technical reporting—will be closely watched by users at other exchanges as well. Security incidents often lead to heightened scrutiny of wallet architecture, signing workflows, and monitoring thresholds, particularly when hot wallet access is implicated.
For now, traders and users should watch whether Bitget meets its withdrawal-resumption timeframe and whether the promised incident report clarifies the precise entry point and the corrective measures for hot and warm wallet handling—especially since early onchain estimates differed from the exchange’s later, broader figure.
This article was originally published as <a href="https://www.cryptobreaking.com/bitget-reports-352m-security-breach/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Bitget Reports $352M Security Breach, Halts Withdrawals</a> on <a href="https://www.cryptobreaking.com/?utm_source=rss&amp;utm_medium=syndication&amp;utm_campaign=article_footer" rel="noopener noreferrer nofollow">Crypto Breaking News</a> – your trusted source for crypto news, Bitcoin news, and blockchain updates.

Bitget Reports $352M Security Breach, Halts Withdrawals

Table of Contents

Crypto Breaking News

Other articles published on Sep 25, 2026

Join our free newsletter for daily crypto updates!