Title: Bitget Hit by $351 Million Crypto Heist as Exchange Freezes Withdrawals

A $350 Million Shock for One of Crypto’s Biggest Exchanges

One of the cryptocurrency industry's biggest exchanges has been hit by a massive security incident. Bitget says approximately $351.6 million worth of digital assets were affected by unauthorized transfers, forcing the exchange to temporarily stop customer withdrawals while it investigates what happened. The incident was detected on September 24 after Bitget's security systems identified unusual transfers from some of its wallets.

For anyone holding cryptocurrency on an exchange, the first reaction to news like this is naturally the same: “Is my money safe?” Bitget says the answer is yes. CEO Gracy Chen said customer funds and account balances remain safe and that the company's User Protection Fund, which holds more than $464 million, is sufficient to cover the reported loss. The exchange says the withdrawal freeze is a security precaution rather than a sign that it does not have enough money to pay customers.

What Actually Happened?

Bitget says its security team detected unauthorized transfers from a limited number of hot wallets. The exchange operates different layers of wallet infrastructure, and according to its security notice, its cold wallets remained secure. Deposits and trading continued operating while withdrawals were paused, giving security teams time to investigate the suspicious activity and prevent additional unauthorized movements.

The scale of the incident became clearer as investigators tracked transactions across multiple blockchain networks. The affected assets reportedly included cryptocurrencies such as XRP, Ethereum, BNB, Avalanche and various stablecoins. Early blockchain tracking showed more than $170 million moving to an unidentified address before the full estimated impact was established at around $351.6 million.

The Attack Was More Complicated Than Simply “Stealing a Private Key”

One of the most important details emerging from the investigation is that the incident does not appear to have been a straightforward theft of private keys. Bitget says the attackers compromised a critical backend system within its wallet infrastructure and used it to manipulate transaction information, eventually triggering the exchange's authorization process to move assets.

That distinction matters. Modern crypto exchanges use multiple layers of security because a single compromised wallet should not automatically give an attacker access to everything. Bitget says its cold wallets and the overwhelming majority of platform assets were not affected. The investigation is still examining exactly how the attackers entered the backend system and manipulated the transfer process.

Bitget Says Customer Money Will Be Covered

Despite the enormous headline figure, Bitget is emphasizing that the stolen assets are not being taken directly from customer account balances. The company says the loss falls within its User Protection Fund, which currently contains more than $464 million according to Bitget. That fund is intended to provide a financial buffer in situations such as this.

That is why the exchange has repeatedly described the withdrawal suspension as a precaution. Bitget says investigators need to make sure the wallet infrastructure is secure before withdrawals are restored. The company has also notified law-enforcement authorities and brought in blockchain-security specialists to help investigate the attack.

Who Is Behind the Attack?

At this stage, attribution should be treated carefully. Bitget has said that some of the attack's technical indicators and IP behavior appeared consistent with patterns associated with North Korean hacking organizations, but identifying the actual perpetrators is part of the ongoing investigation. There is no independent confirmation in the Reuters report that definitively establishes who carried out the attack.

That uncertainty is important because crypto theft investigations can become complicated very quickly. Stolen digital assets can be moved across multiple blockchains, exchanged for different tokens and transferred through different addresses within a short period. Unlike traditional bank transfers, cryptocurrency transactions can cross borders without passing through the conventional banking system.

Another Reminder That Crypto Security Is Never Just About the Blockchain

The Bitget incident highlights an uncomfortable reality about cryptocurrency. Blockchain networks themselves may be designed to make transactions difficult to alter, but the companies and systems built around those networks can still become targets.

Crypto exchanges hold enormous amounts of digital assets in infrastructure that has to remain connected to the internet to process deposits, withdrawals and trading. That makes security an ongoing battle between increasingly sophisticated defenses and attackers looking for weaknesses in software, backend systems and operational processes.

And this is not an isolated problem. In 2025, crypto exchange Bybit suffered a theft of approximately $1.5 billion, which the FBI attributed to North Korean hackers. The repeated appearance of enormous exchange-related thefts shows why security has become one of the most important challenges facing the cryptocurrency industry.

What Happens Now?

For Bitget, the immediate priority is straightforward: secure the affected systems, complete the investigation and restore withdrawals safely. The exchange says it will continue providing updates and publish a fuller incident report covering the root cause and corrective measures.

The bigger question is what users and the wider crypto industry take away from the incident. A company can have hundreds of millions of dollars set aside for emergencies, but that does not make a security breach insignificant. An attack of this size can damage confidence even when customers ultimately receive their funds back.

For Bitget, the coming days will therefore be about more than recovering stolen cryptocurrency. It will be about proving that the systems holding billions of dollars of other people's assets can be trusted again. And in crypto, where trust can disappear much faster than money, that may be the hardest part of the recovery.