Key Takeaways:
- Bitget reported unauthorized transactions of about $351.6 million that occurred in a portion of its hot & warm wallet infrastructure.
- Withdrawals were put on hold for the time being as the exchange’s security team examined the situation.
- Bitget Wallet separately reminded the users to revoke the current permissions of contracts as a precautionary protocol for investigation.
On September 24, Bitget reported some unauthorized transfers from its hot wallets to be one of the biggest crypto security incidents of 2026. The exchange told reporters that its cold wallets are still solid and deposits and trading are still working.
$351.6M Moved From Bitget Wallet Infrastructure
Bitget said its security systems detected abnormal transfers at 18:31 UTC on September 24 and triggered its emergency response procedures within minutes. The exchange estimates that about $351.6 million was affected.
Live about Bitget Hot Wallet Incident on September 24, 2026 https://t.co/limZaY2pRf
— Bitget (@bitget) September 24, 2026
The event only affected parts of the company’s hot and warm wallet layers, the company claimed. The official security notice states that its cold wallets did not get affected. Bitget also noted that the funds in users’ accounts stayed correct, and the affected amount is protected by its User Protection Fund, which exceeds $464 million.
Withdrawals are suspended while a security review is carried out. Bitget’s recent update says that trading and deposits were still open. The exchange revealed that it has detected and marked abnormal receiving addresses and informed police and blockchain security firms.
Read More: Revolut Exposes Bitcoin Records, Passports After Fraudulent Government Email Attack
Bitget Wallet Users Told to Revoke Contract Approvals
The incident also issued another word of caution in regards to Bitget Wallet users.
BitGet has urged users to stop the activation of their trades until more information is provided. If access to some tokens is not required, then unneeded permissions can lower the chances of exposure for an unwanted contract interaction. Bitget’s own security advice suggests visiting the approval logs to cancel permissions no longer required.
Furthermore, Bitget Wallet has announced that it is not affected by the incident with its own wallet systems and user assets, adding that its self-custody wallet infrastructure is independent of the custody wallet network of the exchange.
Investigation Turns to the Attack Route
For now, Bitget hasn’t publicly announced the specific flaw that enabled the unauthorized transfers. The exchange didn’t reveal any more details about the attack vector in its official notification till investigations are complete.
Later, Gracy Chen, the company’s CEO, said the preliminary investigation showed IP addresses that could have been related to VPN services owned by a DPRK-backed hacking group. It was an investigative clue and not an attribution that had been finalized, she said.
Onchain analysts have seen assets pouring into new addresses and being traded betweenDEXs. But it does not map possible movements of the blockchain to tractor owners or the manner in which the initial break-in was made.
Crypto Exchange Security Under the Spotlight
The incident points to the difference of hot wallets, warm wallets and cold storage in centralized crypto exchanges.
Hot wallets remain connected to systems that facilitate transactions, making them useful for day-to-day withdrawals but also exposing them to a larger online attack surface. Cold wallets are kept offline or otherwise isolated from routine online operations.
Bitget said the investigation is ongoing and that it plans to publish a full incident report covering the root cause and corrective actions. The exchange has also said withdrawals will resume after its security review is completed.
Read More: SecondFi Freezes Transactions After $16M ADA Incident, Launches Quarantine Recovery Mode
