Breach Detection and Emergency Response

Cryptocurrency exchange Bitget released an official statement on September 24, 2026, confirming that its security systems detected unauthorized transfers from several hot wallets at 6:31 PM UTC. According to a statement by Bitget CEO Gracy Chen, the company’s security team activated emergency response protocols immediately upon detection. The exchange announced that its emergency response team was activated within minutes, the addresses where the unusual transfers occurred were identified and marked, and relevant parties were notified. Law enforcement and security companies have been officially involved in the investigation process.

[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026
At 18:31 UTC on September 24, 2026, Bitget’s security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately.
What we have…
— Gracy Chen @Bitget (@GracyBitget) September 24, 2026

Wallet Architecture Limits Impact

Bitget emphasized that the incident was limited to only a portion of the hot and warm wallet layers. The company operates a three-layered wallet architecture, and cold wallets were not affected by the breach. This structural segregation prevented the compromise from extending to the majority of user funds held in offline storage. The exchange maintained that account balances are accurate and user assets are protected despite the hot wallet losses.

User Protection Fund Coverage

The company stated that the entire approximately $351.6 million loss could be covered by Bitget’s User Protection Fund, which holds over $464 million in assets. This reserve mechanism is designed to absorb losses from security incidents without impacting individual user holdings. Bitget reiterated that user funds are safe and the protection fund has sufficient capacity to cover the full extent of the unauthorized transfers.

Operational Status and Next Steps

As a precautionary measure while a security review is underway, Bitget has temporarily suspended withdrawal transactions. However, deposits and trading continue as normal. The exchange announced that withdrawals will be reopened after the security review is complete. The company committed to sharing updates on the incident hourly and publishing a comprehensive incident report detailing the cause of the attack, the method used, and corrective measures taken within 24 hours. The method used in the attack has not been disclosed at this stage, and Bitget stated it will not speculate on the attack vector until the investigation is complete.

Why This Matters

The Bitget incident highlights the persistent security challenges facing centralized cryptocurrency exchanges, particularly regarding hot wallet management. Hot wallets, which remain connected to the internet to facilitate rapid withdrawals and trading operations, represent a concentrated attack surface. The exchange’s three-layered architecture—segregating cold, warm, and hot wallets—demonstrates a defense-in-depth approach that successfully contained the breach to the most exposed layer. The existence of a substantial User Protection Fund, capitalized at over $464 million, reflects an industry trend toward self-insurance mechanisms that can absorb losses without requiring bailouts or socialized loss distribution among users. The temporary withdrawal suspension, while disruptive, follows standard incident response protocols to prevent further outflows during forensic analysis. The promised transparency—hourly updates and a detailed post-mortem within 24 hours—sets a benchmark for crisis communication in the digital asset sector. Regulators and industry observers will likely scrutinize the attack vector once disclosed, as it may inform evolving security standards for custodial platforms.

Frequently Asked Questions