Bitget says $352M drained from hot wallets, pauses withdrawals

Crypto exchange Bitget said about $351.6 million was exposed in a system breach on Thursday, September 24, in what CoinDesk reports may be the largest exchange hack of 2026 so far.

The disclosure came from CEO Gracy Chen in a post on X, per CoinDesk, and followed — rather than preceded — alarms from independent on-chain analysts. Chen described "unauthorized transfers from some of our hot wallets" and said the exchange's three-tier wallet architecture limited the damage to "only a portion of the hot wallet and warm wallet layers," with cold wallets "fully secure." She said user funds are safe, pointed to a user protection fund she put at over $464 million, and promised an incident report within 24 hours.

The exchange kept deposits and trading running but "temporarily" paused withdrawals pending a security review, according to CoinDesk.

Independent researchers had flagged the movements first. Emmett Gallic, an analyst at blockchain analytics firm Arkham Intelligence, wrote on X that the transactions touched three Bitget hot wallets and one cold wallet across multiple chains, with proceeds consolidated into a single address, and that the assets included ETH, BNB, AVAX and USDT0. His early estimate was roughly $178 million ("Looks like Bitget just got hacked for $178M"), with more funds moving afterward. Initial on-chain reports cited by CoinDesk put the figure near $183 million.

Key facts

• Amount Bitget says was affected: $351.6 million (CEO Gracy Chen, via CoinDesk).
• Independent early estimates: ~$178M (Arkham's Emmett Gallic, on X); ~$183M (initial on-chain reports cited by CoinDesk).
• Assets moved: ETH, BNB, AVAX, USDT0, consolidated to one address across multiple chains (Arkham analysis, via CoinDesk).
• Status: deposits and trading live; withdrawals paused; cold wallets said to be secure (Chen, via CoinDesk).
• User protection fund: stated at over $464 million (Chen, via CoinDesk).
• Market: BGB down 2.9%, BTC down ~0.29%, ETH down ~0.2% over 24 hours as of 22:10 UTC (CoinDesk).
• Context: Liquid Network lost ~$320M earlier in September 2026 (CoinDesk).

The real-world read

Note the gap: Bitget's own figure (~$352M) is nearly double the analysts' initial ~$178–183M. That spread isn't reconciled yet — Chen's number may reflect total exposure while the on-chain estimates track only what had moved when researchers looked. Either way, the exchange's tally is the larger one, which cuts against any instinct to treat the self-report as damage control.

Everything reassuring here — "user funds are safe," the $464M protection fund, the claim that only hot and warm layers were hit — comes from the company itself, not an independent audit. Those are the CEO's assertions, unverified as of writing, and Bitget disclosed only after outsiders spotted the flows, not before. The pause on withdrawals is the tell that matters more than the messaging: solvency claims are cheap until customers can actually get their money out. The promised 24-hour incident report is the next thing to watch, and whether the numbers in it match the chain.

This is news, not financial advice.

Sources

• CoinDesk (Sept. 24, 2026) — primary reporting on the breach: the $351.6M figure, Chen's statements, withdrawal pause, protection fund, market reaction, and Arkham's analysis. Secondary source; it cited CEO Gracy Chen's X posts and Arkham's Emmett Gallic.