Crypto exchange Bitget suffered a hack that drained roughly $351.6 million from its hot and warm wallets, with the attacker compromising its backend system rather than private keys. Withdrawals remain suspended as the exchange investigates the breach.
The exchange detected the unauthorized transfers at 18:31 UTC on Thursday suspending withdrawals while keeping deposits and trading operational, according to Bitget’s security notice.
Bitget CEO Gracy Chen said the investigation had ruled out a private-key compromise, potentially narrowing the scope of the breach.
“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” Chen said in post on X. “Private key compromise has been ruled out — this excludes the more severe risk scenarios.”
According to Chen, the specific method of system intrusion remains under active investigation,with a full technical report to follow once the exchange confirms the details.
Here is what we can confirm at this stage:
On the attack:
Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization… https://t.co/5nINjwbXpC— Gracy Chen @Bitget (@GracyBitget) September 25, 2026
Bitget said the affected funds are covered by its User Protection Fund, which holds more than $464 million. The exchange has also said that its cold wallets remain secure and that the incident was contained to parts of its hot and warm wallet infrastructure.
“User funds are safe,” Chen said in her initial statement. “We will not run from this. Every dollar and every decision will be accounted for, transparently and in full.”
Withdrawals Remain Paused
The exchange has not yet given users a timeline for when withdrawals will resume.
“Multiple technical teams are working in parallel on system remediation and security hardening,” Chen said. “Withdrawal restoration is being prepared in parallel.”
She added that Bitget would announce a restoration timeline only once it had been confirmed.
“We will not commit to a window we cannot guarantee.”
Onchain analysts had flagged unusual movements from Bitget-linked wallets before the exchange publicly confirmed the breach. More than $170 million in assets had initially been identified moving to an unidentified address, according to The Block. The stolen assets included ETH, USDT, USDC, AVAX and BNB.
Bitget’s $351.6 million estimate makes the incident the largest reported crypto theft of 2026 so far, if the figure holds, with the amount exceeding the roughly $319 million in bitcoin stolen from the Liquid Network earlier this month.