“In crypto, technology can move money in seconds—but one security weakness can move hundreds of millions just as quickly.”
A major security incident has put crypto exchange Bitget in the spotlight.
On September 24, 2026, Bitget detected unauthorized transfers from some of its exchange hot wallets. The exchange initially estimated that approximately $351.6 million in digital assets had been affected. By September 25, Bitget revised the figure upward to approximately $387.5 million after tracing additional transfers.
Bitget temporarily suspended withdrawals while it investigated the incident.
This is an important story—not only because of the amount involved, but because it gives ordinary crypto users a chance to understand how exchanges work, what hot wallets are, why withdrawals can be paused, and why security matters so much in digital assets.
1. First, What Happened to Bitget?
Here is the story in simple language.
September 24, 2026
Bitget’s security systems detected unauthorized transfers at approximately 18:31 UTC.
The affected funds were associated with some of Bitget’s hot and warm wallet infrastructure.
Bitget immediately activated its emergency response process.
Then Bitget paused withdrawals.
The reason given was security protection, while the exchange conducted a review.
Bitget said:
- Cold wallets were not affected.
- Customer account balances remained accurate.
- Deposits and trading were initially kept operational.
- The loss was within the company’s User Protection Fund, which it said held more than $464 million at the time.
- Law-enforcement agencies and blockchain-security firms were contacted.
2. Was It Really a $350 Million Hack?
Yes—but the number has changed.
This is important because early crypto news can change as investigators trace blockchain transactions.
Initial estimate:
$351.6 million
Later estimate:
Approximately $387.5 million
Bitget’s later figure included additional assets and transfers that were identified during the investigation. The Block also reported the revised figure of approximately $387.5 million.
So, if you see headlines saying:
“$350 million Bitget hack”
and others saying:
“$387 million Bitget hack,”
they are referring to the same September 24 incident at different stages of the investigation.
3. What Exactly Was Hacked?
This is where the story gets interesting.
Bitget said the incident involved certain hot and warm wallets, while its cold wallets remained secure.
Let’s understand the difference.
🔥 Hot Wallet
A hot wallet is connected to systems that are online and therefore can be used more conveniently for transactions.
Exchanges need hot wallets because users constantly:
- Deposit
- Withdraw
- Trade
- Transfer assets
But because these wallets are connected to operational systems, they can present a larger attack surface.
❄️ Cold Wallet
A cold wallet is kept offline or otherwise isolated from the internet-facing environment.
It is generally used for longer-term storage and is designed to reduce exposure to online attacks.
Bitget stated that its cold wallets were not affected in this incident.
4. Think of an Exchange Like a Bank
Imagine a bank.
The bank doesn’t keep all its money in one cash drawer.
It has:
- Cash for daily operations
- Operational accounts
- Vaults
- Security systems
- Internal approval procedures
A crypto exchange similarly has different wallet systems.
Simplified model:
User deposits
↓
Exchange infrastructure
↓
Hot/Warm wallets for operational liquidity
↓
Cold storage for larger reserves
This separation is designed to limit the impact of a security incident.
5. How Did the Attack Happen?
The exact technical details were still developing when the initial reports were published.
Bitget’s first security notice said it would not speculate on the attack vector while the investigation was ongoing.
Later reporting citing CEO Gracy Chen said the incident involved attackers compromising a wallet backend and spoofing transaction data, rather than simply stealing a private key. CoinDesk reported that Chen said attackers were able to make fraudulent transfer information appear legitimate to the exchange’s approval process.
Bitget subsequently said its security team had identified the attack path, remediated the underlying vulnerability and was conducting security validation before restoring withdrawals.
The important lesson:
A crypto hack doesn’t always mean:
“Someone stole the private key.”
Modern attacks can target:
- Wallet infrastructure
- APIs
- Backend systems
- Transaction approval systems
- Software vulnerabilities
- Employees
- Access credentials
- Smart contracts
- Third-party systems
6. Why Did Bitget Stop Withdrawals?
This is a question many users naturally ask.
If the exchange says customer funds are safe, why stop withdrawals?
Because during a security incident, the exchange needs to make sure that:
No additional unauthorized transactions can happen.
Imagine discovering that someone has entered a bank’s payment-processing system.
The bank may temporarily stop certain transfers while it:
- Identifies the breach
- Secures the system
- Checks accounts
- Blocks suspicious addresses
- Verifies balances
- Tests the system
- Restores services
Bitget said its withdrawal suspension was a security precaution while its investigation continued.
7. Did Bitget Say User Funds Were Safe?
Yes.
Bitget said the affected loss was covered by its User Protection Fund, which it reported at more than $464 million. It also said customer account balances remained accurate.
However, it is important to separate:
What Bitget says
from
What independent investigators have independently verified.
The company’s statements are important, but the investigation and subsequent recovery process still matter.
8. Who Owns Bitget?
This question needs some clarification.
Bitget is a privately held company, and public information does not provide a simple equivalent of “one publicly traded owner.”
Bitget’s current legal terms identify BTG Technology Holdings Limited as the entity operating the platform.
The company describes its origins as a founding team with backgrounds in traditional finance that became interested in blockchain around 2015 and officially established Bitget in 2018.
So it would be misleading to simply say:
“Gracy Chen owns Bitget.”
Gracy Chen is the CEO—not publicly identified as the sole owner.
She became CEO in May 2024, succeeding Sandra Lou.
9. Who Is Gracy Chen?
Gracy Chen is currently one of the most visible leaders associated with Bitget.
Her background is quite different from the typical image people may have of a crypto executive.
Her education
According to Bitget’s published biography, Chen:
- Studied Applied Mathematics at the National University of Singapore.
- Received a scholarship for her undergraduate studies.
- Later earned an MBA from MIT.
10. Gracy Chen’s Career Before Bitget
Before becoming Bitget’s CEO, Chen worked across several fields.
Journalism & Media
She began her professional career as a financial and technology TV host.
She interviewed business and technology figures and covered financial topics.
Blockchain
Around 2015, she became interested in Bitcoin and other crypto assets after learning about the Bitcoin whitepaper.
She subsequently invested in crypto assets including BTC, ETH and XRP, according to her published biography.
Entrepreneurship
She later worked in fintech and technology startups, including executive roles at Accumulus and XRSPACE, according to Bitget’s biography.
Bitget
She joined Bitget in 2022 as its first Managing Director.
Her role focused on growth strategy and international expansion.
She became CEO in May 2024.
11. Bitget’s Journey: From 2018 to Today
Bitget wasn’t created during the biggest crypto boom.
It was launched in 2018, during a difficult period for the crypto market.
According to Bitget’s own history, its founding team came from traditional finance and became interested in blockchain in 2015. After studying Bitcoin and Ethereum, they decided to build a crypto business.
2018 — Bitget Begins
Bitget.com went live in July 2018.
The company entered the market during a bear-market environment.
2019 — Futures
Bitget launched USDT-margined futures.
According to its own history, futures became an important turning point for the company.
2020 — Copy Trading
Bitget launched its copy-trading product.
This became one of its major differentiating features.
12. 2021–2022: Rapid Expansion
Bitget expanded its global brand and partnerships.
Some important milestones included:
- Partnership with Juventus
- Partnership with PGL
- Launch of a $300 million Protection Fund in 2022
- Partnership with Lionel Messi
- Expansion of its trading ecosystem
The company also expanded beyond simply being a trading platform.
13. Bitget and Bitget Wallet
Another important part of the story is Bitget Wallet.
The wallet was formerly known as BitKeep.
Bitget became BitKeep’s controlling stakeholder in 2023, and BitKeep was subsequently rebranded as Bitget Wallet.
This distinction is important:
Bitget Exchange
Centralized trading platform.
Bitget Wallet
Self-custodial Web3 wallet product.
Bitget said the September 2026 exchange incident did not affect the separate Bitget Wallet infrastructure.
14. Bitget’s Protection Fund
Bitget launched its Protection Fund in 2022 with an initial target of $300 million.
The company later reported that the fund had grown beyond that level. Its September 2026 security notice said the fund held more than $464 million at the time of the incident.
The idea is straightforward:
Exchange suffers covered losses
↓
Protection Fund can potentially be used
↓
Users receive an additional layer of protection
But users should remember that a protection fund is not the same thing as a government-backed bank deposit guarantee.
The exact terms and coverage matter.
15. What Makes This Hack Different?
One reason this incident deserves attention is the scale.
The initial figure was already around:
$351.6 million
Later, the estimated amount became:
$387.5 million
That makes it one of the largest crypto exchange security incidents reported in 2026 so far.
And there is another important point:
The stolen assets were moved across blockchain networks.
Blockchain analytics firms have been tracking the movement of the funds.
Bitquery reported tracing transfers across multiple chains and following subsequent conversions of some of the stolen assets.
This demonstrates one interesting feature of blockchain:
Transactions can be visible on public blockchains, even though the real-world identity behind an address may not immediately be known.
16. Was North Korea Behind the Attack?
This part needs careful wording.
Reports have cited statements from Bitget CEO Gracy Chen linking the attack to a suspected North Korean hacking group.
However, attribution of cyberattacks can take time and requires independent investigation.
Early reports should therefore be described as:
“Bitget suspects a North Korean-linked group”
rather than presenting attribution as an established fact.
Reuters reported the initial hack and Bitget’s response, while later reports cited Chen’s assessment regarding North Korean involvement.
17. Why Are Crypto Exchanges Such Attractive Targets?
Because they manage large amounts of digital assets.
Imagine a traditional bank holding billions of dollars.
It would naturally be a major target for criminals.
Crypto exchanges are similar.
They may hold:
- Bitcoin
- Ethereum
- Stablecoins
- XRP
- BNB
- Other tokens
And because digital assets can move globally within minutes, criminals may attempt to transfer stolen assets rapidly.
This is one reason exchanges invest heavily in:
- Wallet security
- Multi-layer approvals
- Monitoring
- Blockchain analytics
- Cold storage
- Risk controls
- Incident response
18. What Can Ordinary Crypto Users Learn From This?
This is perhaps the most valuable part of the story.
Lesson 1 — Don’t Treat an Exchange Like a Bank
When you leave assets on a centralized exchange, you are relying on the exchange’s:
- Security
- Infrastructure
- Management
- Compliance
- Liquidity
- Risk controls
19. Lesson 2 — Understand Custody
There is a major difference between:
Exchange custody
The platform controls the operational wallet infrastructure.
and
Self-custody
You control your own wallet keys.
Both models have risks.
Self-custody eliminates some exchange-related risks but introduces responsibilities such as:
- Private-key protection
- Seed phrase security
- Phishing protection
- Backup management
20. Lesson 3 — Don’t Keep Everything in One Place
This is a basic risk-management principle.
Imagine having:
100% of your money in one bank account.
If there is a problem with that institution, access could become difficult.
The same principle can apply to digital assets.
Users should understand:
- Where assets are held
- Who controls them
- What protection exists
- What happens if withdrawals are suspended
21. Lesson 4 — Proof of Reserves Is Not the Same as Cybersecurity
This is a very important distinction.
An exchange may publish:
Proof of Reserves
showing assets held at a particular time.
But that does not automatically guarantee:
Perfect cybersecurity
Proof of reserves and security controls answer different questions.
PoR:
“Are certain assets held?”
Security:
“Can unauthorized people access or move them?”
Both matter.
22. Lesson 5 — “User Funds Are Safe” Is a Company Statement, Not a Universal Guarantee
When an exchange experiences a security incident, users should read:
- Official announcements
- Incident reports
- Independent blockchain analysis
- Security-company findings
- Regulatory information
Don’t rely on social-media rumors alone.
23. Bitget Hack Timeline
| Date | Event |
|---|---|
| July 2018 | Bitget.com went live |
| 2019 | USDT-M Futures launched |
| 2020 | Copy trading launched |
| 2022 | $300M Protection Fund launched; Messi partnership |
| 2023 | Bitget became controlling stakeholder of BitKeep; BitKeep became Bitget Wallet |
| May 2024 | Gracy Chen became CEO |
| Sept. 24, 2026 | Unauthorized transfers detected |
| Sept. 24 | Withdrawals temporarily suspended |
| Sept. 25 | Initial estimate: ~$351.6M |
| Sept. 25–26 | Estimate revised toward ~$387.5M as additional transfers were traced |
The historical milestones come primarily from Bitget’s published company materials, while the incident timeline is based on Bitget’s security notices and independent reporting.
24. The Bigger Lesson: Crypto Security Is Not Only About Blockchain
This incident teaches us something very important.
People sometimes say:
“Blockchain is secure.”
That statement is incomplete.
A blockchain network can have strong cryptographic security.
But the wider crypto ecosystem contains:
- Exchanges
- Wallets
- APIs
- Bridges
- Smart contracts
- Cloud infrastructure
- Employees
- Mobile apps
- Backend systems
Any one of these can become an attack surface.
Blockchain security ≠Exchange security
Exchange security = blockchain + software + people + processes + infrastructure + monitoring
26. Final Takeaway
The Bitget incident is bigger than one exchange.
It is a reminder that digital ownership creates digital responsibility.
Blockchain allows money and assets to move incredibly quickly.
That is one of its greatest strengths.
But it also means security failures can move enormous amounts of value at extraordinary speed.
Bitget’s story is also a reminder that companies in this industry can evolve dramatically—from a startup founded in 2018, through futures and copy trading, global partnerships, wallet expansion and tokenization ambitions, to becoming a major global crypto platform.
Now the company faces a different kind of test: how effectively it can investigate the incident, recover funds where possible, protect users and demonstrate that its security controls have been strengthened.
The latest reported figure has moved from $351.6 million to approximately $387.5 million, so the investigation is still an evolving story.
“In the digital economy, owning an asset is only half the story. Knowing how it is stored, protected and transferred is the other half.”
Bitget’s hack is not just a story about stolen crypto.
It is a lesson about custody, cybersecurity, transparency, risk management and the responsibility that comes with controlling digital assets.
This is an educational overview, not a recommendation to use or avoid Bitget or any other crypto exchange. The security investigation and withdrawal status can change as new information is released.