Bitget, a major cryptocurrency exchange, has confirmed a security breach resulting in the theft of approximately $351.6 million in digital assets. The incident, detected at 18:31 UTC on September 24, 2026, targeted the platform’s hot and warm wallets, making it one of the largest exchange heists in recent years.
The company clarified that the breach did not involve the theft of private keys. Instead, attackers successfully compromised a core backend wallet service, allowing them to generate forged transfer requests that the system processed as legitimate transactions. This sophisticated method bypassed traditional security layers by tricking the internal signing process rather than gaining direct access to the underlying cryptographic keys.
Protection Fund to Cover Full Losses
Despite the scale of the theft, Bitget officials stated that individual user balances remain secure. The exchange plans to utilize its $464 million User Protection Fund to cover the entirety of the stolen assets. The fund, which includes a reserve of approximately 5,500 BTC, is designed specifically to act as a buffer against security incidents and market volatility.
According to reports from the Insurance Journal, the exchange has committed to a full reimbursement process, ensuring that the $351.6 million deficit does not impact user accounts. However, because a significant portion of the Protection Fund is held in Bitcoin, its total valuation remains subject to market price fluctuations.
Asset Breakdown
On-chain analysis of the movement of funds provides a granular look at the assets siphoned during the three-hour window following the initial breach detection. The stolen portfolio was heavily weighted toward major tokens and stablecoins:
- 102.93 million XRP (valued at approximately $157 million)
- 31,890 ETH (valued at approximately $85 million)
- 34.75 million USDT
- Remaining balances in USDC and AVAX
Current Operational Status
In response to the exploit, Bitget has temporarily suspended all cryptocurrency withdrawals to prevent further unauthorized transfers and to facilitate a comprehensive audit of its backend services. While withdrawals are frozen, the exchange confirmed that trading services and deposits remain fully functional. The company has not provided a definitive timeline for the restoration of withdrawals, noting that services will resume only after the backend wallet service has been fully hardened and verified.
