Bitget suspends withdrawals after $351.6 million hot wallet breach

Bitget halts withdrawals after unauthorized hot wallet transfers

Bitget said about $351.6 million in assets were affected by unauthorized transfers from a limited number of its hot wallets on Sept. 24, 2026, and that it has temporarily suspended withdrawals. A hot wallet is a crypto wallet that stays connected to the internet, which makes it convenient to use but more exposed to attacks than a wallet kept offline.

Bitget said its security systems identified the unauthorized transfers at 18:31 UTC. The exchange posted its statement at 5:34 p.m. ET, confirming an incident that on-chain observers had been tracking through the afternoon. It said its security team immediately started emergency procedures and a full investigation.

What Bitget's statement says

• Bitget said its cold wallets — wallets kept offline — and the overwhelming majority of platform assets remain secure and unaffected.
• The exchange said customer account balances remain accurate.
• It said the incident falls within the coverage of Bitget's User Protection Fund, which it says holds more than $464 million.
• Bitget said it flagged the transfer addresses and formally engaged law enforcement agencies and leading on-chain security partners.
• The exchange said it will not speculate on how the attack happened while the investigation is ongoing.

Withdrawals paused across all listed assets

Bitget described the withdrawal pause as a precaution while its teams complete a security review, and said it is working around the clock to restore withdrawal services as soon as it is safe.

The suspension covers everything the exchange lists. When The Defiant queried Bitget's public API at 5:30 p.m. ET and again at 6:05 p.m. ET, none of the 4,930 asset-network entries it returned, covering 5,288 assets, were marked withdrawable. Deposits were listed as enabled, and the ETH/USDT spot pair was listed as online.

The halt widened over about 75 minutes. At 4:15 p.m. ET, the same endpoint marked ETH withdrawals as disabled on Ethereum alone, while Arbitrum, Optimism and Base were still listed as enabled.

Bitget chief executive Gracy Chen posted the notice in English and then in Chinese with the same figures. She said the platform runs a three-tier wallet system, that she would post updates hourly, and that she was preparing a live stream to take questions.

Blockchain records track about $165 million to one address

Wallets labeled as belonging to Bitget sent about $165 million to the same address across Ethereum, Arbitrum, Optimism and Base, according to The Defiant's tally of blockchain-explorer records. The ten large transfers occurred between roughly 2:59 p.m. and 4:09 p.m. ET — beginning 28 minutes after the time Bitget says it identified the unauthorized transfers, and continuing for more than an hour after that.

That tally is lower than the exchange's figure. It adds the explorers' displayed dollar values for ten transfers into a single address, using valuations taken when checked rather than prices at execution, and it excludes other networks and onward transfers to avoid double-counting. It measures funds moved, not a verified loss, and the attribution to Bitget rests on the explorers' address labels. The receiving address was 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee on all four networks.

What the Ethereum, Arbitrum, Optimism and Base records show

On Ethereum, Etherscan's transaction records show four large ETH transfers from wallets labeled "Bitget 6" and "Bitget 35." Its token-transfer records also show about 34.75 million USDT and 12.85 million USDC from Bitget 6, plus 3,000.32 Tether Gold tokens from "Bitget 5," worth about $12.8 million at the token's price on Thursday. Those seven Ethereum transfers totaled about $126 million at the explorer's displayed valuations.

Separately, Arbiscan recorded 19.67 million USDT0 arriving from a wallet labeled Bitget 6. OP Mainnet Etherscan recorded 5,737.68 ETH from Bitget 5, and Basescan recorded 1,555.32 ETH from "Bitget 3." All three of those transfers occurred at about 3:01 p.m. ET.

The pseudonymous X account DCF GOD, which flagged the Arbitrum activity more than three hours before Bitget's statement, asked whether the Bitget hot wallet might have just been attacked for $20 million.

Where the receiving wallet's funds went

Arbiscan records show the recipient forwarded the 19.67 million USDT0 to 0xe410a2E5710Ee787bcaa63f52A3943ff71F0d946 at about 3:34 p.m. ET. That address held no USDT0 when The Defiant queried an Arbitrum node at 5:35 p.m. ET.

The receiving address is an externally owned account rather than a contract on all four networks, node queries show. At 5:35 p.m. ET it held 4,596.48 ETH on Ethereum, worth about $12.4 million, and balances of less than one cent each in USDT, USDC and Tether Gold. Its ether balances on Optimism and Base stood at 0.0101 ETH and 0.0082 ETH, against the 5,737.68 ETH and 1,555.32 ETH the explorers recorded arriving earlier in the afternoon. The Defiant could not determine where the outgoing funds went.

BGB slides as the news spreads

BGB, Bitget's exchange token, traded at $1.98, down 2.8% over 24 hours, with a market capitalization of $1.38 billion on $40.6 million of 24-hour volume, according to CoinGecko.

A Sygnum custody deal announced hours earlier

Hours before the transfers, Bitget announced it had moved institutional collateral into off-exchange custody with Swiss bank Sygnum, placing that collateral in segregated accounts held away from the exchange's balance sheet. That arrangement covers institutional collateral, not retail balances. Bitget says it serves more than 125 million users.

How it compares with earlier exchange failures

The largest crypto theft on record is the $1.5 billion taken from Bybit in February 2025. Two smaller exchanges stopped withdrawals this year: Orionx in September and AscendEX in July.

What is confirmed

Bitget has confirmed the unauthorized transfers, the $351.6 million figure, the temporary withdrawal suspension, that its cold wallets were unaffected, that the incident falls within its User Protection Fund coverage, and that it has engaged law enforcement and on-chain security partners. Blockchain explorers show the transfers described above, though the link to Bitget depends on those explorers' address labels.

What is still unclear

Bitget has not said how the wallets were compromised, has not published a breakdown of the $351.6 million, and has not named the addresses it flagged. It has said it will not speculate on the attack vector while the investigation continues. The Defiant's on-chain tally of about $165 million is smaller than the exchange's figure, and the destination of the outgoing funds from the receiving address is not known.

Why it matters for exchange users

A crypto exchange is a platform where people buy, sell and store digital assets. While withdrawals are paused, customers cannot move their assets off the platform, even though deposits and trading continued. The size of the affected amount and the fact that the transfer addresses have been flagged mean the investigation now involves law enforcement and outside security firms, according to Bitget's statement.

What happens next

Bitget said it is working to restore withdrawal services once it is safe to do so. Gracy Chen said she would post updates every hour and was preparing a live stream to answer questions. The exchange has not given a timeline for when withdrawals will resume.

Sources

• The Defiant