Bitget Security Incident: $351.6M Affected as Exchange Pauses Withdrawals

Bitget says unauthorized transfers affected approximately $351.6 million across part of its hot and warm wallet infrastructure, while cold wallets remained secure. Withdrawals were paused during the security review and Bitget says its User Protection Fund covers the loss.

Bitget said its security systems detected unauthorized transfers at 18:31 UTC on September 24, 2026. The exchange activated its emergency response process, identified and flagged abnormal transfer addresses, notified law enforcement and on-chain security firms, and temporarily suspended withdrawals.

The company says deposits and regular trading remained operational. A separate September 25 notice said Bitget Onchain trading was temporarily unavailable while the broader security review continued.

What Bitget has confirmed

Bitget's official incident notice puts the estimated affected assets at approximately $351.6 million. It says the incident was contained to a portion of its hot-wallet and warm-wallet layers and that cold wallets remained secure.

Bitget also says customer account balances remain accurate and that the loss falls within its User Protection Fund, which it said held more than $464 million when the notice was issued. That is the exchange's statement about coverage; NetNapz will monitor subsequent disclosures for evidence of reimbursements, fund movements and restored services.

Withdrawals paused while the review continues

Bitget temporarily suspended withdrawals as a precaution while investigators reviewed the incident. The exchange said deposits and trading remained available and that withdrawals would return after the security review was completed. Bitget Onchain trading was separately listed as temporarily unavailable on September 25.

For customers, restoration of withdrawals is one of the clearest near-term operational milestones. The other is publication of the promised full incident report, including root-cause analysis and corrective actions.

What is not yet established

NetNapz is not presenting a specific attack mechanism or actor as settled fact. Bitget's initial official notice explicitly said it would not speculate on the attack vector before the investigation was complete. Reports and security researchers may develop attribution theories, but those should remain clearly separated from confirmed findings until the exchange or investigating authorities publish evidence.

This distinction matters because an incident involving exchange wallet infrastructure can have very different implications depending on whether the root cause is key compromise, authorization-system failure, application compromise, insider activity or another mechanism. The initial disclosure does not establish that answer.

Bitget Wallet says self-custodied assets were unaffected

Bitget Wallet, the separate self-custodial product, said its systems and users' self-custodied assets were unaffected. It said the wallet operates independently from Bitget Exchange with separate infrastructure and custody architecture.

The wallet also warned users about phishing attempts that can follow high-profile security incidents. Users should not disclose seed phrases or private keys or follow unsolicited instructions to move assets for supposed security verification.

Why the incident matters for the crypto market

A loss of this scale is material for exchange-counterparty risk even when an operator says customer losses are covered. The immediate questions are whether withdrawals resume normally, whether the protection fund absorbs the loss as stated, whether additional unauthorized transfers emerge, and whether the investigation identifies weaknesses with implications beyond the affected wallet layers.

The event should not automatically be converted into a directional signal for Bitcoin or the wider crypto market. The more defensible market read is to monitor exchange-specific liquidity and counterparty confidence while separating those risks from broader crypto price action.

What NetNapz is watching next

Operational confirmation: restoration of withdrawals and Bitget Onchain services without additional security restrictions.

Investigation: the promised incident report, verified root-cause findings, the affected chains and assets, and any authoritative attribution.

Customer protection: evidence that the User Protection Fund is used as stated and that customer balances and withdrawals remain whole.

Security spillover: warnings from other exchanges, chains or infrastructure providers indicating whether the incident exposes a wider vulnerability.

Bottom line

Bitget has confirmed a major security incident affecting approximately $351.6 million in assets in portions of its hot and warm wallet infrastructure. Cold wallets were reported secure, withdrawals were paused, and the exchange says its protection fund covers the loss. The key unresolved issue is the root cause. Until authoritative findings are released, claims about the precise attack mechanism or responsible actor should be treated as unconfirmed.

Sources

Bitget — security notice, September 24, 2026
Bitget — withdrawal suspension notice
Bitget — Onchain transaction delay notice, September 25
Bitget Wallet — self-custody security statement

NetNapz provides news, market monitoring and scenario analysis, not personalised financial advice.