Crypto exchange Bitget confirmed that attackers stole roughly $351.6 million from its hot and warm wallets on 24 September 2026, after unauthorized transfers were detected at 18:31 UTC. The exchange says its offline cold wallets were untouched and that customer account balances remain accurate.
What happened
Bitget CEO Gracy Chen says the attacker did not steal a private key. Instead, they compromised a backend system inside the exchange's wallet infrastructure, spoofed transaction data, and used it to trigger Bitget's own withdrawal-authorization process. Chen described it as the digital equivalent of "slipping forged withdrawal slips through a bank's teller window." On-chain analytics firm Arkham Intelligence was among the first to flag the unusual outflows, which included ETH, BNB, AVAX, USDT and USDC; the attacker reportedly swapped much of the stablecoin and altcoin balance into ETH afterward.
Bitget's response
Bitget paused withdrawals while it runs a security review, though deposits and trading stayed open. The exchange says the loss is fully covered by its User Protection Fund, which held more than $464 million at the time, and that "loss containment is confirmed" with no further unauthorized transfers possible. Investigators reported preliminary evidence pointing to IP infrastructure resembling networks previously linked to a North Korean hacking group, though attribution has not been formally confirmed.
What it means for futures traders
The Bitget breach is a reminder that custody risk sits with the exchange, not just with your own account security — even a platform with more than 125 million users can have a backend system compromised. It is also a case where a stronger private key or two-factor setup on the user's own account would not have helped, because the exploit ran through the exchange's internal authorization flow, not through any individual login. Leveraged futures trading carries a high risk of loss on its own; a platform-level breach is a separate risk layered on top of it, and it is worth spreading meaningful balances across more than one exchange rather than concentrating everything in one place.
BitMe does not currently integrate with Bitget, but on every exchange it does support, it connects with a read-only API key and never asks for withdrawal permission — a small piece of the same custody-hygiene habit this incident is a reminder of.