Bitget Suspends Withdrawals After Unauthorized Transfers Affect About $351.6 Million

Key Facts

Bitget temporarily suspended withdrawals after detecting unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24. The exchange estimated that about $351.6 million in funds were affected, describing the figure as an initial assessment of the assets involved. It said cold wallets were unaffected, while deposits and trading continued during its security review. The withdrawal pause prevents customers from moving assets off the exchange through the normal service even if their balances remain visible. Bitget said withdrawals would resume after the review, without setting a fixed reopening time. The eventual impact will depend on the final accounting, the investigation's findings and how the protection pledge is carried out.

The $351.6 million figure is Bitget's estimate of funds affected by the transfers, rather than a published final tally of irrecoverable assets. The company said its User Protection Fund held more than $464 million and that the amount involved fell within its coverage. Comparing those figures shows the scale of the protection Bitget says is available, but does not establish when or how the fund would be used for customers. The fund's value, the amount transferred and the balances displayed in user accounts are different measures of the incident. That distinction matters to someone awaiting a withdrawal: an accurate displayed balance cannot be moved through a suspended withdrawal service. Completion of the security review remains Bitget's stated condition for restoring that function.

The immediate operational effect turns on the difference between trading on an exchange and transferring an asset to an outside wallet. Bitget said deposits and trading remained available while it paused withdrawals as a precaution during its security review. A customer may therefore still change a position within a trading account but cannot use the normal withdrawal route to move the asset elsewhere. That matters to traders who need to shift collateral or holdings between venues, because executing a trade is different from transferring its proceeds. The pause restricts outward movement while the exchange checks unauthorized transfers and the safety of the service. Continued trading does not, by itself, mean the withdrawal system has passed that review.

Bitget said it uses a 3-tier wallet structure and that the incident was confined to part of its hot and warm wallet layers. Hot wallets support operations connected to trading and transfers, making their activity central to a review of unauthorized movements. The exchange said its cold wallets remained secure, a distinction that helps define the extent of exposure within its wallet structure. That does not settle how much can be recovered from the affected wallets or change the effect of the customer withdrawal pause. Bitget's notice did not identify a specific software flaw or a definitive method of attack. Its promised investigation is therefore needed to explain how the unauthorized transfers passed its controls.

Bitget said it activated an emergency team within minutes of detecting the transfers and identified and reported addresses linked to the unusual activity. It also said it notified law enforcement and firms specializing in onchain security. Those actions address different tasks: limiting the risk of further transfers and tracing funds that have already moved. Identifying a receiving address does not establish that assets have been recovered or show how the person responsible obtained transfer authority. Progress in the investigation and restoration of withdrawals are consequently separate outcomes for customers to watch. The exchange said displayed account balances were accurate while keeping withdrawals suspended pending its security review.

The protection fund's reported value of more than $464 million follows Bitget's disclosure that it averaged $382 million in August. The August number is a full-month average, whereas the later figure is the value reported at the time of the incident; their difference does not establish a new cash contribution. Bitget describes the fund as an additional safeguard for user assets, and the dollar value of its holdings changes with asset prices. Assessing its ability to absorb a loss requires attention to which assets can be used and how they would be allocated, as well as to the published total. The reported value exceeds the estimated affected amount, but a coverage statement alone does not set out a compensation process. Further fund disclosures will show how Bitget intends to carry out its pledge if a final loss is confirmed.

In a report issued before the incident, Bitget said its aggregate September reserve ratio was 135% across 19 covered assets. That ratio describes the assets measured against the covered customer balances at the time of the report. It serves a different purpose from the protection fund: the report measures backing for balances within a defined scope, while Bitget says the fund is available for exceptional losses. A reserve measurement taken before the incident cannot, by itself, settle the effect of later transfers or the timing of resumed withdrawals. Holders therefore need post-incident operational updates alongside periodic reserve reports to assess the current position. Differences in timing and scope limit a direct comparison between the two measures.

For a customer holding assets at Bitget, the practical questions are when those assets can again leave the exchange and how its protection pledge would work if a final loss is established. Buying and selling may remain possible within an account, as the company says, while the withdrawal pause constrains a move to another venue. Investors assessing exposure to the platform should separate that documented operational restriction from assumptions about a price response in related assets. The extent of the affected wallet segment, the duration of the pause and the means of funding any reimbursement will shape that assessment. The estimate of affected assets alone cannot establish a final company liability or a direct loss for every customer. Bitget's assurance about account balances is also separate from the timetable for accessing them through withdrawals.

Bitget promised continuing updates and an incident report within 24 hours covering root cause and corrective measures. It said withdrawals would return after the security review but did not announce a specific reopening hour. The practical test of restored service will be whether customers can again transfer assets off the exchange reliably. A root-cause report may show whether the full scope of the incident has been identified and what measures address the unauthorized transfers. A final accounting of affected funds and details of any protection-fund use would then show how the coverage pledge is implemented. Until those results emerge, $351.6 million remains an initial estimate and the length of the withdrawal pause remains open.