Key Takeaways
- • Bitget experienced a breach of $351.6 million in cryptocurrency assets from hot and warm wallet layers on September 24, 2026, with CEO Gracy Chen confirming unauthorized transfers across multiple blockchains including ETH, BNB, AVAX, and USDT.
- • The exchange's three-tier wallet architecture (cold, warm, and hot wallets) contained the breach to non-cold storage; cold wallets and user funds remain fully secure according to the company's statement.
- • Bitget's User Protection Fund, capitalized at $464 million, provides full coverage for the $351.6 million loss, meaning individual user balances are protected despite the hack.
- • The exchange suspended withdrawals temporarily pending a security review and incident report promised within 24 hours; deposits and trading operations remained online during the suspension period.
- • Blockchain analytics firms including Arkham Intelligence independently corroborated the breach through onchain data, tracking fund consolidation into a single address across multiple blockchains.
Summary
Bitget, a major cryptocurrency exchange, disclosed a significant security breach on September 24, 2026, affecting $351.6 million in digital assets. CEO Gracy Chen announced the incident via social media, confirming that unauthorized transfers occurred from portions of the exchange's hot and warm wallet layers. The breach was initially flagged by independent blockchain researchers who detected unusual wallet movements before the formal company announcement.
The exchange operates a three-tier wallet architecture designed to compartmentalize risk: cold wallets (offline storage with signing credentials isolated from internet infrastructure), warm wallets (intermediate layer), and hot wallets (connected to transaction-processing systems). According to Chen's statement, the breach was contained to the hot and warm wallet layers only, with cold wallets remaining fully secure. This architectural separation proved critical in limiting the scope of the exposure.
User funds remain protected through Bitget's User Protection Fund, which holds over $464 million in reserves. The company confirmed that the full $351.6 million loss falls within this fund's coverage, meaning individual user account balances are safeguarded from direct loss. Blockchain analytics firm Arkham Intelligence independently corroborated the breach, tracking consolidated fund movements across multiple blockchains involving three hot wallets and one cold wallet, with assets including ETH, BNB, AVAX, and USDT being moved to a single consolidation address.
In response to the incident, Bitget temporarily suspended withdrawals while conducting a comprehensive security review, though deposits and trading operations continued. The exchange committed to publishing a detailed incident report within 24 hours of the disclosure. This response mirrors industry protocols following major exchange breaches, balancing operational continuity with security remediation.
The exchange operates a three-tier wallet architecture designed to compartmentalize risk: cold wallets (offline storage with signing credentials isolated from internet infrastructure), warm wallets (intermediate layer), and hot wallets (connected to transaction-processing systems). According to Chen's statement, the breach was contained to the hot and warm wallet layers only, with cold wallets remaining fully secure. This architectural separation proved critical in limiting the scope of the exposure.
User funds remain protected through Bitget's User Protection Fund, which holds over $464 million in reserves. The company confirmed that the full $351.6 million loss falls within this fund's coverage, meaning individual user account balances are safeguarded from direct loss. Blockchain analytics firm Arkham Intelligence independently corroborated the breach, tracking consolidated fund movements across multiple blockchains involving three hot wallets and one cold wallet, with assets including ETH, BNB, AVAX, and USDT being moved to a single consolidation address.
In response to the incident, Bitget temporarily suspended withdrawals while conducting a comprehensive security review, though deposits and trading operations continued. The exchange committed to publishing a detailed incident report within 24 hours of the disclosure. This response mirrors industry protocols following major exchange breaches, balancing operational continuity with security remediation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.