Bitget Hit by $351.6M Wallet Breach, Temporarily Suspends Withdrawals

Bitget confirms $387.5M in affected assets as its recovery bounty targets the freezing and return of stolen funds.

Crypto exchange Bitget has suffered a major security breach involving hundreds of millions of dollars in digital assets. Unauthorized transfers began on September 24, prompting an emergency response and a temporary suspension of withdrawals. Deposits and trading remain operational while security teams investigate the incident.

Bitget Detects Unauthorized Wallet Transfers

Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure on September 24. Security teams activated emergency procedures within minutes and began identifying suspicious addresses.

According to Bitget, its cold wallets were unaffected by the breach, and user account balances and assets remain accurate and protected. The firm initially placed the affected funds at roughly $351.6 million and stated that its User Protection Fund could cover the reported loss. 

[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026

At 18:31 UTC on September 24, 2026, Bitget's security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately.

What we have…

— Gracy Chen @Bitget (@GracyBitget) September 24, 2026

Further investigation later raised the amount transferred to attacker-controlled addresses to approximately $387.5 million. Bitget said the revision resulted from additional transaction classification rather than from new unauthorized transfers.

Additional assets identified on Zcash and TRON accounted for part of the difference. Affected networks include Ethereum and several EVM chains, XRP Ledger, Zcash and TRON. Assets involved include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX. 

Bitget Launches Recovery Bounty Program

Recovery efforts have already frozen some affected assets with help from industry partners, according to Bitget. The firm has also introduced a Recovery Bounty Program for eligible parties who directly help freeze or recover affected funds.

Eligible participants may receive 5% of funds successfully frozen through their voluntary actions. Another 5% may apply to funds successfully recovered through qualifying efforts.

Actions carried out under court orders, law-enforcement requests or other legal processes do not qualify for bounty payments. Bitget will make final decisions regarding eligibility and payment amounts. The exchange will also use Bybit’s LazarusBounty initiative as a key channel for its fund-tracing and recovery efforts. 

Withdrawals Remain Suspended

Withdrawal services remain unavailable while technical teams conduct security checks and prepare systems for reopening. Bitget’s September 24 withdrawal notice said services would return after its security review is completed.

Bitget plans to announce the status and timing of withdrawal restoration by September 26. Meanwhile, Bitget Wallet said its separate self-custodial service was not affected by the exchange incident. 

Its systems and users’ self-custodied assets remain operational, according to the statement. Moreover, independent cybersecurity firms Mandiant and SlowMist are assisting Bitget with the investigation and fund-tracing work. Fund tracing and the wider investigation remain active, meaning the confirmed loss figure could change as more transactions are classified.