Bitget has confirmed a hot wallet security breach that moved roughly $351.6 million in crypto out of the exchange on September 24, making it one of the largest centralized exchange incidents
Bitget has confirmed a hot wallet security breach that moved roughly $351.6 million in crypto out of the exchange on September 24, making it one of the largest centralized exchange incidents of the year. CEO Gracy Chen said in a security notice posted on X that Bitget’s security systems detected unauthorized transfers from some of its hot wallets at 18:31 UTC and activated emergency response protocols within minutes. Withdrawals have been temporarily suspended while the exchange conducts a security review, though deposits and trading remain operational.
Chen said the breach was contained to a portion of Bitget’s hot and warm wallet layers, and that its cold wallets remain secure. The exchange estimated that approximately $351.6 million was affected, and Chen said the full amount falls within Bitget’s User Protection Fund, which currently holds more than $464 million. User account balances remain accurate and customer assets are protected, the notice said, and the exchange has flagged the addresses tied to the abnormal transfers.
The confirmation arrived hours after blockchain security researchers began flagging large, multi-chain movements from wallets labeled as Bitget’s. Analysts including DCF GOD and Bubblemaps tracked a fresh wallet that spent 19.67 million USDT0 on 7,111 ETH in about six minutes on Arbitrum, paying up to 5% above market through UniswapX and 1inch Fusion. The transfers spanned multiple chains and included ETH, USDT, USDC, AVAX and BNB, with the funds consolidated into a single fresh address. Early estimates placed the suspicious outflows near $174 million, then roughly $183 million as more transactions surfaced, before Bitget disclosed its own higher figure.
Bitget has not identified the attack vector and said it would not speculate while the investigation is underway. Chen promised hourly updates through official channels and said a full incident report covering the root cause and corrective actions would be published within 24 hours. The exchange said it notified law enforcement and onchain security firms as it works to trace the stolen funds.
The breach extends a difficult stretch for crypto platform security. Chainflip paused operations earlier this month after a Tron USDT exploit, and SlowMist recently warned of a full-chain iOS exploit capable of stealing wallet keys.
