Bitget breach drains $351.6M, makes September costliest

Bitget reported that unauthorized transfers removed roughly $351.6 million from several of its hot and warm wallets on Sept. 24. The exchange suspended withdrawals and launched a security review after detecting the activity.

The transfers were detected at 18:31 UTC and emergency response procedures were activated within minutes. Bitget reported that cold wallets and the majority of assets held on the platform were unaffected. Deposits and trading continued while withdrawals remained paused. The company said customer balances are intact and that the loss is covered by Bitget’s User Protection Fund, which it reports holds more than $464 million. Gracy Chen, Bitget’s chief executive, said: “The full amount of this loss falls within the coverage of Bitget’s User Protection Fund.” Chen added the exchange will keep withdrawals suspended until the security review is complete and pledged that “every dollar and every decision will be accounted for, transparently and in full.”

On-chain analysis identified a series of transfers tied to the incident. Fifteen transfers moved nearly $192 million across seven assets, with Ethereum representing about 44.4% of that subset. Bitget’s total affected-assets figure of about $351.6 million reflects additional movements and assets that remain under review. The exchange has not confirmed an attack vector and has said it will not speculate while investigators work.

Bitget flagged addresses connected to the transfers and notified law enforcement and specialist on-chain security firms. The company said it will issue hourly updates and publish a full incident report within 24 hours that will describe the root cause and recommended corrective measures. Restoring withdrawals is the exchange’s immediate priority once the security review is complete.

The incident increases reported crypto thefts for September. Before the Bitget breach, trackers had recorded roughly $331 million in losses across 17 incidents earlier in the month, with later exploits pushing that figure above $342 million. Adding Bitget’s affected-assets figure brings September’s reported total to above $684 million, exceeding April’s roughly $646.9 million in losses. April’s total was driven largely by two incidents that accounted for about $577 million of that month’s losses. Monthly totals remain subject to change as investigations determine whether funds can be recovered or are ultimately classified as lost.

The breach occurred during Bitget’s eighth-anniversary campaign. The exchange has been promoting an expansion beyond crypto into equities, foreign exchange and other markets as part of a Universal Exchange strategy. Bitget said it will account for decisions and funds transparently as it works through the investigation and restoration process.