Bitget Reports $351M Hot Wallet Breach, Says User Funds Are Covered

Cold wallets, which hold most of Bitget’s assets, were never touched at all, the exchange says, even as hot and warm layers took the hit.

Bitget says its security systems flagged unauthorized transfers from a portion of its hot wallets at 18:31 UTC on September 24, with roughly $351.6 million in assets affected.

The exchange says every dollar of that loss falls under its User Protection Fund, so customers’ balances will stay intact even with withdrawals paused as it reviews the incident.

What Bitget Says Happened

According to CEO Gracy Chen, Bitget runs a three-tier wallet system, and the breach touched a slice of the hot and warm wallet layers. Cold wallets, which hold the bulk of the exchange’s assets, were not affected, and the security team’s emergency protocols kicked in within minutes of the detection, flagging and reporting the addresses tied to the abnormal transfers.

The exchange’s User Protection Fund currently holds more than $464 million, well above the $351.6 million shortfall, and Bitget plans to use it to cover the full loss.

“We will not run from this, and every dollar will be accounted for,” Chen wrote in an update posted on X. She added that a full incident report, covering root cause and corrective steps, would follow within 24 hours of the initial notice.

According to Bitget, the attacker got into a backend system inside its wallet infrastructure, used it to spoof transaction data, and tricked the exchange’s authorization process into releasing funds.

Chen ruled out a private key compromise, which narrows what went wrong, and stated that containment is confirmed, with no further unauthorized transfers possible.

You may also like:

Lazarus Group Could Be Responsible

On-chain investigator Specter claimed that the North Korea-linked Lazarus Group was behind the attack, a position supported by analyst Conor Grogan.

“Generally they do these on the weekends but perhaps they had a limited window for the exploit and didn’t want to risk it,” Grogan wrote.

The incident adds to what has been an eventful stretch for crypto exploits, with $1.1 billion stolen across 212 incidents in the first half of the year, and more than half of that traced back to the Lazarus Group.