Bitget reports $351.6M wallet hack; withdrawals halted

How the Numbers Moved

Early reports placed the loss at around $180 million based on hot wallet outflows spotted shortly after the breach, including a transfer of 7,111 ETH. That figure came from on-chain monitoring before Bitget had issued an official statement, and it reflected only what analysts could see moving in real time.

Once Bitget’s CEO confirmed the incident directly, the full scope came out closer to $351.6 million, nearly double the initial estimate. That kind of gap is common in the early hours of an exchange hack, since outside observers can only track what’s visible on-chain while the exchange itself has to piece together everything that moved across affected systems.

What Bitget Says Happened

The breach was detected at 18:31 UTC on September 24, compromising a critical backend system within Bitget’s wallet infrastructure. According to CEO Gracy Chen, attackers spoofed transaction data to trigger the authorization process and move funds out, rather than stealing a private key directly.

Bitget ruled out a private key compromise entirely, pointing instead to this spoofing method as the attack vector. The breach affected portions of the exchange’s hot and warm wallet infrastructure, while cold wallets, which stay offline and are harder to reach, remained secure throughout.

Withdrawals Stay Paused

Customer withdrawals remain unavailable as of this report. Deposits and trading continue operating normally, so users can still access the platform, they just can’t pull funds out yet.

Chen has not given a firm timeline for when withdrawals will resume. We will announce a timeline as soon as one is confirmed, she said. Service will only be restored after a complete security review, which suggests Bitget is prioritizing certainty over speed.

The Case for User Funds Being Safe

Bitget maintains that user funds are safe despite the breach. Here’s why the exchange is making that claim:

• The company’s User Protection Fund holds over $464 million, enough to cover the entire loss
• Customer account balances reportedly remain accurate and unaffected
• Abnormal transfer addresses have already been identified and reported
• Law enforcement and on-chain security firms are involved in the ongoing investigation

Blockchain analytics platform Lookonchain reported that about $183 million of the stolen funds were swapped for Ether, giving outside researchers a way to track the funds even without official confirmation from Bitget.

What’s Still Unknown

The specific method attackers used to gain initial access remains under investigation. Bitget has said it won’t speculate on the attack vector until that work is complete, and a full technical report is expected once the investigation wraps.

This incident adds to a long list of security events in the crypto exchange space, and how quickly Bitget restores withdrawals will matter a lot for user confidence going forward.

Hashlytics Take

The jump from $180 million to $351.6 million isn’t a correction, it’s what happens when early on-chain sleuthing meets the slower reality of an exchange’s internal forensics. Neither number was wrong exactly, they were just measuring different things at different points. The more useful signal here isn’t the dollar figure at all. It’s that Bitget ruled out a private key compromise and pointed to transaction spoofing instead, which says more about where exchange security actually breaks down than any headline number does.