Bitget Suspends Withdrawals After $351.6M Hot-Wallet Incident

Bitget has temporarily suspended withdrawals after detecting unauthorized transfers from some of its hot wallets, marking one of the largest confirmed exchange-security incidents of 2026.

The exchange said its monitoring systems detected the transfers at 18:31 UTC on September 24. Bitget currently estimates that approximately $351.6 million was affected. It said the breach was contained to part of its hot- and warm-wallet layers and that its cold wallets remain secure.

Withdrawals are unavailable while the company conducts a security review. Deposits and trading remain operational, according to a separate service notice.

What Bitget has confirmed

Bitget says abnormal recipient addresses have been identified, flagged and reported. The exchange has activated an emergency response team and says law enforcement and on-chain security firms are involved.

The company also says customer account balances remain accurate and that the full loss is covered by its User Protection Fund, which it values at more than $464 million.

Those statements are material, but they remain issuer claims pending independent reconciliation. Coverage by a protection fund is not the same as restored withdrawal access, and the size, liquidity and deployment mechanics of that fund will matter if reimbursements become necessary.

What remains unknown

Bitget has not confirmed the attack vector. It has promised a full incident report within 24 hours covering root cause and corrective actions, and says it will provide hourly updates through official channels.

The next evidence should answer four questions:

1. Which wallet systems and assets were affected? 2. How much of the reported outflow has been frozen or recovered? 3. How will Bitget reconcile liabilities, reserves and protection-fund coverage? 4. What conditions must be satisfied before withdrawals resume?

Until those details are published, the safest conclusion is narrow: Bitget has confirmed unauthorized hot-wallet transfers and a temporary withdrawal suspension, but the technical cause and final net loss are still under investigation.

Users should rely only on Bitget's official channels and treat unsolicited “recovery” messages, support contacts and withdrawal links as potential phishing attempts.