Bitget Loses $351.6M In Hot Wallet Breach, Suspends Withdrawals
Crypto exchange Bitget said it lost about $351.6 million to a hot wallet breach on Sept. 24 and has paused customer withdrawals while its security review runs.
Key Takeaways
- Bitget detected unauthorized transfers at 6:31 p.m. UTC and said emergency protocols started within minutes
- The confirmed figure is more than twice the sum blockchain monitors had traced before the company spoke
- Chief Executive Gracy Chen said cold wallets were untouched and the loss sits inside a user protection fund holding over $464 million
- Deposits and trading stayed open, with no date given for withdrawals to restart
Detection And The First Response
Bitget said its monitoring systems flagged the transfers and triggered an internal response the same evening.
The company described a three-tier wallet setup and said the damage reached parts of the hot and warm layers only.
Suspect addresses have been tagged and passed to outside parties, Chen said. Law enforcement and blockchain security firms are involved.
Trackers Saw Less Than Half
Independent monitors had put the outflows far lower.
Telegram service MLM reported four wallets moving funds, with more than $170 million turned into Ethereum, and said one cold wallet was among them. Bitget rejects that last point.
Also Read: Gemini Live Launch Adds Animated Avatar to Voice Assistant
Etherscan records for one receiving address show it opened at 7:05 p.m. UTC, ran 15 transactions inside an hour and held 4,373 ETH.
The exchange’s own estimate is roughly double what anyone outside the company could see.
Withdrawals Paused, Trading Open
Customers can still deposit and trade. They cannot take money out.
Chen said balances shown in accounts are accurate and customer holdings are covered.
The protection fund leaves about $112 million above the stated loss, a cushion of roughly 1.3 times.
“Bitget has navigated multiple market cycles. We will not run from this,” Chen said.
Report Promised Within A Day
How attackers reached the wallets has not been explained.
“We will not speculate on the attack vector until the investigation is complete,” Chen said.
The company promised hourly updates and a full incident report inside 24 hours. Whether the $351.6 million estimate survives that report is the open question.
Read Next: 56% Of Americans Have Never Heard Of Stablecoins, Visa Study Finds
