(Sept 25): Crypto exchange Bitget reported an estimated US$351.6 million in unauthorised transfers from some of its wallets and temporarily suspended withdrawals.

“User funds are safe,” chief executive Gracy Chen said in a post on X early Friday in Singapore. “The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over US$464 million.”

The hack continues a spate of recent attacks that have put crypto cybersecurity in the spotlight. Earlier this month, US$320 million worth of Bitcoin was drained from a wallet used by Liquid Network, while in August the hack of the popular offline Bitcoin wallet Coldcard raised questions about the safest way to store the digital asset.

Founded in 2018, Bitget is one of the leading centralised crypto exchanges globally. It was among those that grew rapidly after the collapse of FTX in 2022 as traders shifted activity to surviving platforms. The Seychelles-registered exchange currently has 120 million registered users, according to its website. 

The hack “is one of the most substantive centralised exchange exploits of 2026” and “another wake-up call for the digital-assets industry,” said Esme Pau, head of capital markets and policy at blockchain security firm CertiK. “The scale of the drain at around three quarters of the exchange’s User Protection Fund transcends a security lapse and makes it a crisis event.”

The hackers swapped about US$183 million of the stolen funds for Ether tokens, according to blockchain analytics platform Lookonchain.

Chen said Bitget operates a three-tier wallet architecture and the breach was confined to portions of hot-wallet and warm-wallet layers, with cold wallets remaining secure. Hot wallets stay online for frequent transactions, cold wallets stay offline for maximum security, while warm wallets sit in between.

“Deposits and trading remain fully operational,” Chen said. “Withdrawals are temporarily paused and will be restored as soon as the security review is complete.”

A full incident report including root cause analysis and corrective actions will be published within 24 hours, she said.

In preliminary comments on the method of the hack, Chen said on X that hackers had “compromised a critical backend system” and “used it to spoof transaction data.” The company suspects North Korea, she said in a livestream on X.

In a separate post, Chen said that stolen assets include Ether, XRP, BNB, AVAX, USDT and USDC, adding that some of the foundations of the affected chains are freezing the hackers’ wallet addresses to prevent the funds from being swapped out.

Aneirin Flynn, chief executive of cybersecurity technology firm FailSafe, said the significance of the Bitget hack “is that it destroys the illusion that major exchanges have solved hot-wallet security.”

“Even though their protection fund covers the loss, a breach of this size severely damages institutional trust in crypto infrastructure,” he said.

Uploaded by Liza Shireen Koshy