Incident Overview

On September 24, 2026, Bitget, a significant player in the cryptocurrency exchange market, reported a substantial security breach. It was confirmed that unauthorized transfers had led to the theft of approximately $350 million in digital assets from the exchange’s hot wallets.

Details of the Breach

According to Bitget CEO Gracy Chen, the hack exclusively affected hot wallets—those connected to the internet for daily trading—while cold wallets remained secure and unaffected. Upon detecting the irregular activity, Bitget’s security protocols were swiftly activated.

Transaction Flow and Initial Signs

Shortly after the incident was detected, on-chain analysts noted significant fund transfers from wallets associated with Bitget. Roughly $183 million was moved to a newly created address within an hour. One of the most notable transactions involved a fresh wallet that acquired 7,111 ETH for approximately $19.67 million in USDT0 in a matter of minutes.

Exchange Response and User Assurance

In a series of communications via social media, Gracy Chen reassured users, stating, “User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million.” This fund is designed to cover potential losses from incidents like hacking and theft.

Analysis of the Transactions

The initial transfer occurred from a hot wallet and went through decentralized exchanges UniswapX and 1inch Fusion, with the hacker reportedly paying up to a 5% premium to expedite the transaction. This behavior aligns with typical patterns seen during emergency fund diversions during a breach.

Following this major transaction, further outflows of ETH, AVAX, BNB, USDC, USDT, and XAUT were recorded, signaling an orchestrated attempt to divert a range of assets rapidly.

Security and Industry Implications

The Bitget incident serves as a stark reminder of the vulnerabilities faced by centralized exchanges, which have a history of being targeted by cybercriminals. This event marks one of the most significant losses in recent years, following a similar incident where Bybit lost $1.4 billion in February 2025.

Despite the challenges, Coinbase’s protection fund aims to safeguard user assets, but the incident reiterates the cryptocurrency community’s mantra: “not your keys, not your coins.” This highlights the essential practice for users to control their private keys to ensure the security of their holdings.