What to Know

  • Bitget said $351.6 million was exposed in a system breach on Thursday.
  • CEO Gracy Chen said cold wallets and user funds were safe.
  • The exchange described the activity as unauthorized transfers from some hot wallets.
  • Bitget said its three-tier wallet architecture contained the breach to part of the hot wallet and warm wallet layers.
  • The exchange said deposits and trading remain online, while withdrawals are temporarily paused pending a security review.
  • Bitget maintains a user protection fund that Chen said held over $464 million.
  • Independent blockchain watchers initially flagged around $183 million in unusual movements from wallets labeled as belonging to the exchange.
  • Arkham Intelligence analyst Emmett Gallic said the transactions involved three Bitget hot wallets and one cold wallet across multiple blockchains, with funds consolidated into a single address.
  • Assets cited in the observed movements included ETH, BNB, AVAX and USDT0.
  • Bitget’s BGB token fell after news circulated and was down 2.9% as of press time, while bitcoin was down some 0.29% and ether was down 0.2% over the past 24 hours.

Bitget Discloses Major Wallet Breach

Crypto exchange Bitget said it had $351.6 million exposed in a system breach on Thursday, marking one of the largest security incidents disclosed by a centralized trading platform this year. CEO Gracy Chen said the exchange detected unauthorized transfers from some of its hot wallets, while emphasizing that cold wallets and user funds were safe.

The disclosure followed unusual onchain wallet activity flagged by independent blockchain researchers. Early observations pointed to large movements from wallets labeled as belonging to Bitget, before the exchange publicly addressed the incident and provided a higher exposure figure. The company said it would publish an incident report within 24 hours, a step that will be closely watched by users, counterparties and security researchers seeking a fuller accounting of the breach.

Chen said Bitget operates a three-tier wallet architecture and that the breach affected only a portion of the hot wallet and warm wallet layers. In exchange security design, hot wallets are typically used to support withdrawals and trading operations because they remain connected to transaction systems. Warm wallets can serve as an intermediate layer, while cold wallets are designed to keep key material isolated from internet-connected infrastructure. That separation is meant to reduce the risk that a compromise of operational wallets can spread to long-term reserves.

Withdrawals Paused as Security Review Begins

Bitget said deposits and trading remain online, but withdrawals have been temporarily paused while the exchange completes a security review. The temporary withdrawal halt is a common containment measure after a suspected wallet compromise, as platforms attempt to prevent additional unauthorized outflows, verify wallet controls and determine whether private keys, signing systems or internal permissions were affected.

For users, the immediate operational distinction matters. Keeping trading and deposits online suggests the exchange is attempting to preserve core market functions, while pausing withdrawals reflects caution around asset movement. However, users will likely focus on the duration of the withdrawal pause, the scope of affected wallets and the details of any reimbursement or protection mechanism if losses are confirmed.

Chen said Bitget’s user protection fund held over $464 million. Such funds are often intended to provide a backstop during exceptional events, though their use depends on the terms set by the exchange and the specific circumstances of an incident. The exchange’s statement that user funds are safe is therefore central to market confidence, but the promised incident report will be important for clarifying what was exposed, what was moved and how Bitget plans to restore normal withdrawal operations.

Onchain Researchers Flagged Unusual Movements

Before Bitget’s public update, onchain data and independent blockchain researchers identified unusual wallet movements. Initial estimates pointed to around $183 million in digital assets moving from wallets labeled as belonging to the exchange. As more activity was reviewed, Bitget later disclosed the larger $351.6 million exposure figure.

Emmett Gallic, an analyst at blockchain analytics firm Arkham Intelligence, said the observed transactions involved three Bitget hot wallets and one cold wallet across multiple blockchains. He said funds were consolidated into a single address and identified assets including ETH, BNB, AVAX and USDT0. He also said more funds were moving after the initial observations, underscoring how quickly a wallet incident can evolve across chains once abnormal activity begins.

Blockchain transparency gives researchers the ability to track large asset flows in near real time, but early labels and interpretations can shift as additional transactions appear. Wallet labeling, chain-specific bridges, token wrappers and internal exchange wallet structures can complicate the first read of an incident. That is why exchanges typically follow early public alerts with formal internal assessments, including wallet inventories, transaction hashes, system timelines and containment measures.

Why Hot Wallet Breaches Matter

Hot wallets remain one of the most sensitive parts of crypto exchange infrastructure because they support fast withdrawals and settlement. Their connection to operational systems creates convenience for customers but also expands the potential attack surface. If an attacker gains access to signing authority, transaction approval processes or infrastructure used to move funds, assets can be transferred rapidly across several blockchains.

Cold wallets are built with a different risk profile. They are designed to keep signing credentials away from online systems, often requiring more deliberate and manual processes before funds can move. That makes cold storage less flexible for day-to-day exchange operations, but more resilient against remote compromise. Bitget’s statement that cold wallets remain fully secure is therefore a critical element of its effort to reassure users.

The distinction between user balances and wallet-level asset movements can also be complex for customers. Centralized exchanges generally pool assets across wallets while maintaining internal account ledgers for users. A breach of operational wallets can affect the exchange’s asset inventory without automatically changing what customers see in their account balances. Whether the exchange absorbs the loss, uses a protection fund or recovers assets can determine the ultimate user impact.

Potentially One of the Biggest Hacks of 2026

If the $351.6 million exposure figure is confirmed as a loss, the Bitget incident would rank as possibly the biggest hack of 2026. The scale also comes during a difficult stretch for crypto security. Earlier in September, Liquid Network lost $320 million in another hack, although attackers in that case claimed to be white hat hackers.

Large exchange breaches can affect confidence beyond the directly targeted platform. Market participants often watch for signs of contagion, including token selloffs, liquidity stress, delayed withdrawals or emergency communications from other venues. Security incidents can also renew scrutiny of proof-of-reserves practices, wallet segmentation, internal controls and the governance of emergency response plans.

Crypto infrastructure has matured significantly, but exchange wallet security remains a high-stakes challenge. Attackers may target private keys, internal tooling, cloud infrastructure, employee credentials or transaction approval workflows. Exchanges must balance customer demand for fast withdrawals with the need to limit how much capital sits in internet-connected environments. The Bitget incident highlights how that balance remains central to operational resilience.

Market Reaction: BGB Falls, Bitcoin and Ether Edge Lower

Bitget’s native token, BGB, fell sharply after news of the breach began circulating, but had recovered a bit by 22:10 UTC. The token was down 2.9% as of press time. Bitcoin was down some 0.29%, while ether was down 0.2% over the past 24 hours of trading.

The relatively modest moves in bitcoin and ether suggest the broader market reaction was contained at the time of the update, though exchange-specific incidents can remain fluid. Native exchange tokens are often more directly exposed to platform confidence because they can be tied to trading incentives, fee discounts, user loyalty programs or broader perceptions of an exchange’s financial health.

For BGB, traders will likely watch withdrawal updates, the incident report and any details about the use of Bitget’s user protection fund. If the exchange can demonstrate that user balances are unaffected, cold storage remains intact and withdrawal service resumes after review, market pressure may ease. If the incident report reveals broader infrastructure weaknesses or a longer operational disruption, sentiment could remain fragile.

What Comes Next for Bitget Users

The next major checkpoint is Bitget’s promised incident report within 24 hours. Users will be looking for clear answers on the timeline of the unauthorized transfers, the exact wallet layers affected, the assets involved, the total amount moved, the recovery status and the conditions required to reopen withdrawals. The market will also scrutinize whether the exchange identifies the attack vector or outlines concrete steps to prevent a recurrence.

Communication speed and precision are critical during exchange security events. Customers generally want immediate assurance, but overly broad claims can backfire if later details change. Bitget’s message so far has centered on containment, the safety of cold wallets, the preservation of user funds and the existence of a user protection fund exceeding the disclosed exposure.

Until withdrawals resume, the situation remains unresolved from a user-experience standpoint. Trading access may remain available, but the ability to move assets off-platform is a core measure of confidence for many crypto users. FXCOINZ will continue to track the exchange’s operational updates, onchain movements and market response as the security review progresses.

Frequently Asked Questions (FAQs)

How much did Bitget say was exposed in the breach?

Bitget said $351.6 million was exposed in a system breach on Thursday. The figure followed earlier onchain observations that initially pointed to around $183 million in unusual movements from wallets labeled as belonging to the exchange.

Did Bitget say user funds are safe?

Yes. CEO Gracy Chen said user funds were safe and that Bitget’s cold wallets remain fully secure. The exchange described the breach as involving unauthorized transfers from some hot wallets and affecting only part of the hot wallet and warm wallet layers.

Are Bitget withdrawals available?

Bitget said withdrawals are temporarily paused while it completes a security review. Deposits and trading remain online, according to the exchange’s update.

What assets were mentioned in the unusual wallet movements?

Arkham Intelligence analyst Emmett Gallic identified assets including ETH, BNB, AVAX and USDT0 in the observed transactions. He said the activity involved three Bitget hot wallets and one cold wallet across multiple blockchains.

What is the difference between a hot wallet and a cold wallet?

A hot wallet is connected to operational systems used for activity such as processing withdrawals, which makes it more accessible but also more exposed. A cold wallet is designed to keep signing credentials isolated from internet-connected infrastructure, making it more secure for longer-term storage.

What is Bitget’s user protection fund?

Bitget maintains a user protection fund that Chen said held over $464 million. Such funds are generally intended to provide a backstop during unusual events, though the exchange’s incident report is expected to provide more clarity on how it may respond to this breach.

How did BGB react to the news?

Bitget’s native token, BGB, fell sharply after the breach news began circulating, then recovered a bit by 22:10 UTC. It was down 2.9% as of press time.

How did bitcoin and ether move after the disclosure?

Bitcoin was down some 0.29%, while ether was down 0.2% over the past 24 hours of trading. The broader market reaction appeared more contained than the move in BGB at the time of the update.

Could this be the biggest crypto hack of 2026?

If the $351.6 million exposure is confirmed as a loss, the Bitget incident would be possibly the biggest hack of 2026. It follows another major September incident in which Liquid Network lost $320 million.