Bitget Pauses Withdrawals After Wallet Breach Affects Estimated $351.6 Million

Key Facts

Bitget confirmed unauthorized transfers from some of its wallets on September 24, 2026, and estimated that $351.6 million in assets were affected. It temporarily suspended withdrawals for a security review while trading remained available and initially said deposits continued. An early estimate of transfers visible to blockchain observers was about $183 million before the exchange disclosed a broader assessment. Bitget said customer account balances were accurate and its user protection fund covered the estimated loss, assurances whose practical value depends on restored access to funds. A balance displayed in an account is different from an asset a customer can move off the platform during a withdrawal halt. The financial assessment therefore turns on the final loss, how it is covered, the time needed to restore service and the number of wallets involved.

Bitget said its security systems detected the transfers at 18:31 UTC on September 24, 2026, and activated emergency procedures immediately. The $183 million figure came from early flows out of addresses labeled as Bitget wallets toward a new address, according to Decrypt's account of blockchain activity. Bitget's $351.6 million figure is its estimate of assets affected across the incident, rather than a measurement of that initial set of visible flows. The amounts should therefore not be added together: one was an early partial observation, while the other was the company's later, broader assessment. Their different scope makes a final breakdown of the assets and wallets counted more useful than a comparison of the two headline figures alone. Such a breakdown will show how much the protection fund must cover and whether the current estimate approaches the loss established by the review.

An exchange controls wallets holding customer assets and processes transfers on customers' behalf, making authorization of those transfers a direct counterparty risk. A large movement to a new address alone cannot establish theft, because a blockchain record shows the transfer without necessarily revealing its operational purpose. Bitget, however, explicitly identified the transfers in this case as unauthorized, linking the observed activity to a security breach rather than suspicion alone. The company said the affected wallets were limited to parts of its hot and warm layers and that cold wallets remained secure. Hot wallets support routine operations, so a withdrawal pause can interrupt a transfer channel while permissions and transactions passing through it are reviewed. For customers, the decisive test is whether assets can again be moved out safely, not merely whether trades can still be executed inside their accounts.

Reported transfers included ETH, AVAX, BNB and stablecoins across several networks, requiring any aggregate estimate to account for each asset and the route it followed. Decrypt reported that a new address used 19.67 million USDT0 to buy 7,111 ETH in 6 minutes on Arbitrum. The transaction illustrates why tracking one token is insufficient: value that leaves as a stablecoin may become a different asset before the incident is fully measured. Movements among several networks and wallets also require analysts to avoid counting the same value twice as they assemble an estimate. Early descriptions of some addresses as cold wallets did not establish that offline custody keys had been compromised, particularly given Bitget's statement that its cold layer was secure. Public wallet labels and the operational scope of the breach therefore remain distinct matters for the technical investigation to resolve.

Chief Executive Gracy Chen gave a preliminary account, according to reports of her remarks, in which attackers breached a backend wallet-service system and used it to generate false transfer data. The reports said she described that data entering an approval and signing process that allowed funds to leave the exchange. If confirmed, that route would put the focus on validation of a transfer request before signing, not just on the address that ultimately received assets. Chen also said a private-key leak had been ruled out, according to those reports, while the precise method of entry remained under investigation. That qualification is consistent with Bitget's statement that it would not settle the attack vector before the investigation was complete. For a risk assessment, the technical report must show whether the controls that accepted those requests have been changed sufficiently to prevent a repeat.

Bitget said its user protection fund held more than $464 million and covered the full loss it currently estimates at about $351.6 million. The stated fund value exceeds the affected amount on the company's figures, but that comparison alone does not establish when claims can be funded or withdrawals made available. In its September 2026 reserve update, Bitget reported an overall reserve ratio of 135% and expanded disclosure to 19 assets. The ratio describes a position at the time of that update; it does not automatically measure a subsequent loss or the speed at which customers can receive funds. The protection fund is intended to absorb the stated loss, while the reserve disclosure describes assets held against customer liabilities at its measurement date. The significance of both figures will become clearer when Bitget explains how it will deploy the fund and resume withdrawals while maintaining the account balances it says are accurate.

For customers holding assets on Bitget, the timing of restored withdrawals matters more immediately than the ability to trade one asset for another within an account. The gap between the early $183 million outflow estimate and Bitget's $351.6 million assessment shows how exposure estimates can change as an inquiry covers more activity. It does not by itself demonstrate a new loss after the first estimate, because the two figures do not measure the same set of assets and transfers. Bitget initially said deposits and trading continued, then warned on September 25 that some cryptocurrency deposits might take longer to appear in customer accounts. That warning adds another operational issue for customers to monitor even as the company's statement about continued trading stands. Its assurance that cold wallets were secure also cannot alone establish the liquidity needed once withdrawal requests can be processed again.

Bitget said it would issue regular updates and a full report covering the root cause and corrective action. Its withdrawal notice links publication of that report to service restoration and says it will appear within 24 hours after withdrawals resume. Before then, customers will be able to judge the security review by whether transfers off the platform actually restart, since trading access does not provide the same ability to move assets. The report will then need to explain the attack route and affected wallet layers and establish the amount the protection fund must cover. A change to the $351.6 million estimate or the wallet scope would change the assessment of the incident's cost and the exchange's ability to meet its commitment. Delivery of compensation and stable withdrawals will offer a clearer measure of the breach's effect on customers than an inferred price move in any token.