Bitget detected unauthorized transfers draining approximately $351.6 million from hot and warm wallets at 18:31 UTC on September 24, 2026, prompting immediate suspension of withdrawals and activation of emergency procedures.
The cryptocurrency exchange’s Chief Executive Officer Gracy Chen confirmed that “the full amount of this loss falls within the coverage of Bitget’s User Protection Fund,” which maintains a balance of $464 million. Cold wallets and most assets on the platform remained unaffected. Customer balances are accurate, and deposits and trading continue to operate normally.
The breach involved 15 transfers that drained nearly $192 million across seven assets, with Ethereum comprising 44.4% of that amount. Bitget identified and flagged addresses connected to the transfers and notified law enforcement agencies and on-chain security firms. The attack vector remains unknown pending investigation.
Chen stated that “every dollar and every decision will be accounted for, transparently and in full.” Bitget plans to publish a full incident report within 24 hours of the detection.
September 2026 Crypto Losses Reach New High
The Bitget incident pushes September 2026 crypto losses to a 2026 high. According to DeFiLlama data, crypto losses across 17 September incidents totaled $331 million before September 19. After the Fetch.ai exploit, which included a $1.55 million theft linked to one wallet, September losses reached $342 million. The Liquid Network incident accounted for $320 million in losses.
With the Bitget breach included, projected September losses total $684 million. April 2026 remains the second costliest month for crypto exploits in 2026, with $646.9 million in losses. The Drift and KelpDAO attacks combined for $577 million of that April total.
Exchange Operations and Recovery Timeline
Bitget continues normal operations for deposits and trading while withdrawal services remain suspended. The exchange has not disclosed which specific seven assets were affected in the 15 transfers or confirmed whether affected assets will be recovered or classified as losses.
Bitget operates under a Universal Exchange strategy, expanding beyond cryptocurrency into equities and foreign exchange offerings. The breach occurs during the exchange’s eighth-anniversary campaign period.
