started · updated
Bitget confirms $351.6 million security breach via hot wallet exploit
Cryptocurrency exchange Bitget has confirmed a major security breach occurring on September 24, 2026, with estimated losses of approximately $351.6 million. The attack targeted portions of the exchange's hot and warm wallet layers, though Bitget emphasized that its cold wallets remained secure and unaffected.
CEO Gracy Chen stated that the breach was caused by an infiltration of the wallet service's core backend system, where attackers forged transaction data to trigger unauthorized authorization signatures. Chen clarified that private keys were not leaked and that the incident has been contained.
On-chain data revealed that the attackers rapidly converted stolen stablecoins, such as USDT and USDC, into Ethereum (ETH) to prevent issuers from freezing the assets. The stolen funds included various assets like ETH, BNB, AVAX, and tokenized gold (XAUT).
Bitget has temporarily suspended all withdrawals while conducting a comprehensive security review and plans to release a full technical report within 24 hours. The company assured users that their account balances remain accurate and that the $464 million-plus User Protection Fund is sufficient to cover the full extent of the losses.
Entities
Arkham · Bitget · Circle · Ethereum · Ethereum · Gracy Chen · Tether · Uniswap · UniswapX · Wu Blockchain
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 11 SOURCES] Bitget founder Gracy Chen stated that user funds remain safe and the incident was contained to hot and warm wallet layers. news.bitcoin.com · portaldobitcoin.uol.com.br · bitcoinmagazine.com · blockchainseoul.kr · www.blockmedia.co.kr · +3 more
- [● 8 SOURCES] The exchange's $464 million-plus protection fund is expected to cover the full extent of the losses. www.spacemoney.com.br · news.bitcoin.com · ambcrypto.com · blockchainseoul.kr · www.blockmedia.co.kr · +1 more
- [● 5 SOURCES] The attacker rapidly converted stolen stablecoins into Ethereum to prevent them from being frozen by issuers. livecoins.com.br · www.spacemoney.com.br · blockchainseoul.kr · coingape.com
- [● 12 SOURCES] Bitget confirmed a security breach on September 24, 2026, with estimated losses of approximately $351.6 million. www.spacemoney.com.br · news.bitcoin.com · portaldobitcoin.uol.com.br · blockchainseoul.kr · www.blockmedia.co.kr · +5 more
- [● 6 SOURCES] Bitget has temporarily suspended withdrawals while conducting a security review and plans to issue a full report within 24 hours. www.spacemoney.com.br · news.bitcoin.com · portaldobitcoin.uol.com.br · blockchainseoul.kr · www.blockmedia.co.kr
- [● 8 SOURCES] The attacker moved assets including ETH, USDT, USDC, AVAX, BNB, and XAUT across multiple blockchain networks. www.spacemoney.com.br · livecoins.com.br · unchainedcrypto.com · ambcrypto.com · blockchainseoul.kr
- [● 2 SOURCES] The hacker infiltrated the core backend system of the wallet service to forge transfer information and trigger authorization signatures. www.blockmedia.co.kr
- [● 2 SOURCES] Bitget confirmed that private keys were not leaked during the incident. www.blockmedia.co.kr