Update as of Sept. 25, 2026 at 4:13 PM (UTC):
Cryptocurrency exchange Bitget temporarily suspended withdrawals and on-chain trading services after an estimated $351.6 million was removed in a security breach targeting its hot wallets on Sept. 24, 2026, at 18:31 UTC, the company announced. According to the exchange, its security systems detected unauthorized transfers from its hot and warm wallet layers, prompting the immediate activation of emergency response protocols.
Details of the Incident
According to Bitget CEO Gracy Chen, the unauthorized transfers involved assets across multiple blockchains, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain, and Base. Chen stated that XRP represented the largest single-chain loss, while other affected assets included ETH, BNB, AVAX, USDT, USDC, and various altcoins. Bitget confirmed that its cold wallets remain secure and unaffected by the breach.
The company also stated that Bitget Wallet, its decentralized wallet application, operates independently from the exchange infrastructure and was not impacted.
Financial Protection and User Assets
Bitget stated that all user funds remain secure and that the financial losses from the incident fall within the coverage of the exchange’s User Protection Fund, which currently holds over $464 million. During a live stream, Chen noted that Bitget holds over $1 billion in proprietary assets beyond the protection fund, stating that user funds are covered on a 1-to-1 basis.
The company added that deposits and standard platform trading remain fully operational, while on-chain trading and withdrawals are paused pending a security review.
Investigation and Response
The exchange reported that its emergency response team identified and flagged the abnormal transfer addresses within minutes of detection. Bitget stated it has formally notified relevant authorities and on-chain security firms globally to assist with the investigation.
According to Chen, initial analysis of IP behavioral patterns and on-chain signatures suggests the attack aligns with methods used by hacking groups linked to the Democratic People’s Republic of Korea (DPRK). She noted that several blockchain foundations have been contacted, and some have already frozen wallet addresses associated with the attacker.
Service Restoration Timeline
Bitget stated it aims to resume full withdrawal services as soon as the ongoing security review is complete, though a specific time window has not yet been announced. The company said it will release a full incident report, including a root cause analysis and corrective actions, within 24 hours after withdrawals are restored.
Due to high inquiry volumes, Bitget noted that live chat support wait times currently exceed 15 minutes, adding that users can also submit inquiries through the platform’s Support Hub. Updates will continue to be provided through Bitget’s official announcement center and social media channels, the company stated.
This article is published on BitPinas: Bitget Suspends Withdrawals Following $351.6 Million Hot Wallet Security Breach
What else is happening in Crypto Philippines and beyond?
Be the first to comment