Bitget Hack: $352M Stolen as Withdrawals Are Paused

Attackers drained roughly $351.6 million from Bitget on 24 September, and the offshore exchange has frozen withdrawals while it investigates. If the figure holds, it would rank as the biggest exchange breach so far in 2026. Bitget says customer balances are untouched and that its reserve fund can absorb the entire loss.

Not a key theft, says the CEO

The first question after any exchange hack is whether private keys were stolen. Bitget CEO Gracy Chen says they were not. “Private key compromise has been ruled out,” she said. By her account, the attackers broke into the exchange's wallet backend and injected spoofed transaction data. Bitget's own authorisation process then treated those fake instructions as genuine and signed off on the transfers.

That distinction matters. A stolen key can empty a wallet at will, while a backend compromise points to a flaw in how withdrawals are checked and approved.

The timeline and the money trail

• Alarm raised: on-chain watchers noticed unusual wallet activity, and the unauthorised transfers were flagged at about 18:31 UTC on 24 September, which is just after midnight in India.
• Wallets hit: the funds came out of Bitget's hot wallets, which hold online liquidity, and its warm wallets, a semi-connected buffer layer. Several chains were involved, among them Ethereum, BNB Chain and Avalanche, and the haul included USDT. The attacker then pooled everything into one address.
• A rising tally: Emmett Gallic of Arkham Intelligence initially spotted about $178 million leaving several Bitget wallets. That estimate was later revised up to $351.6 million.
• Cold storage intact: Chen said the exchange uses a three-tier wallet structure and that its cold wallets remain fully secure.

Where users stand now

According to Bitget, no account balance has changed, and its User Protection Fund, worth more than $464 million, covers the stolen amount in full. Trading and deposits are still running. Withdrawals, however, are suspended until a security review is complete. Chen said several technical teams are working on a fix in parallel, but she did not say when withdrawals will restart. The exchange has also committed to publishing an incident report.

Bitget's own BGB token dropped steeply as the news spread, before clawing back part of the fall to sit about 2.9% lower.

What Indian Bitget users should do

Bitget operates offshore, so Indian customers have fewer local routes for help if something goes wrong. For now, the sensible steps are simple:

• Don't make panic moves while withdrawals are frozen.
• Ignore anyone who messages you promising to “recover” or “unlock” your funds. Phishing and fake-support scams routinely follow big hacks.
• Take screenshots of your balances and keep them safe.
• When withdrawals resume, think about shifting long-term holdings into a wallet you control or onto an FIU-registered Indian platform.

The breach is the second major jolt for offshore venues this month, coming soon after BitMEX and CoinEx announced shutdowns.

FAQ

How much was stolen in the Bitget hack?

Roughly $351.6 million left Bitget's hot and warm wallets on 24 September 2026.

Are Bitget withdrawals open?

Not yet. Deposits and trading continue, but withdrawals are on hold during a security review, with no restart date announced.

Will Bitget users lose money?

Bitget says user balances are unchanged and that its User Protection Fund of more than $464 million covers the full loss.

---

This article is AI-assisted, educational and general in nature. It is not financial advice and never a guarantee of profit. Every trade is at your own risk on your own exchange. See our risk disclosure and editorial policy.