Bitget's Breach Hit Three-Quarters of Its Protection Fund, and Withdrawals Already Have a Return Date

Signal Spotlight · Asia-Pacific crypto and fintech, exchange security

What happened

Bitget's security systems detected unauthorized transfers from a limited number of hot wallets at 18:31 UTC on September 24, 2026, prompting the exchange to activate emergency response procedures and suspend withdrawals, as reported by Bloomberg, CoinDesk, and multiple other outlets. Bitget CEO Gracy Chen confirmed the breach directly on X: "User funds are safe," she said, noting "the full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million." Chen said Bitget operates a three-tier wallet architecture, hot, warm, and cold, and the breach was confined to portions of the hot and warm layers, with cold wallets remaining secure. Deposits and trading continued operating normally throughout.

The loss figure has moved twice since initial reports. Early on-chain estimates ranged from roughly $176 million to $183 million, before Bitget's own confirmation put the affected assets at approximately $351.6 million, a figure the exchange has since revised to roughly $387.5 million once Zcash and TRON assets were included. On-chain researchers traced approximately $183 million of the stolen funds being swapped into Ether. Bitget's technical team says it has identified and fixed the underlying vulnerability, working with external cybersecurity firms Mandiant and SlowMist to verify the fix. Chen has floated a possible North Korea link based on IP and VPN similarities, though no government has publicly attributed the attack, and that connection should be treated as an open question, not a confirmed conclusion.

Esme Pau, head of capital markets and policy at blockchain security firm CertiK, called it "one of the most substantive centralized exchange exploits of 2026," noting the scale of the drain "around three quarters of the exchange's User Protection Fund transcends a security lapse and makes it a crisis event."

Bitget has since published a staged withdrawal resumption timeline. Bitcoin withdrawals resume first, at 08:00 UTC on September 28, with Ether, USDT, and other networks following in stages through October 2, giving the exchange room to verify each network individually before reopening it.

Why it matters

The confirmed proportion is the detail worth sitting with longest. A loss representing roughly three-quarters of the entire User Protection Fund is a materially different situation than a breach comfortably absorbed by reserves with room to spare. The fund does currently cover the confirmed loss, but the margin is thin enough that CertiK's own characterization as a "crisis event" rather than a routine security lapse is the more accurate framing than "user funds are safe" taken in isolation.

The staged resumption timeline is genuinely useful operational information, not just a reassurance signal. A defined, asset-by-asset schedule running through October 2 gives any operator or platform with Bitget exposure a concrete calendar to plan around, rather than an open-ended wait. That said, a resumption schedule confirms Bitget's own confidence in having addressed the immediate vulnerability, it doesn't independently verify that confidence, and platforms with material exposure should treat the schedule as a planning input, not a closed matter.

This is also the second major centralized exchange or wallet security event in September alone, following a $320 million breach at Liquid Network earlier the same month, on top of the Coldcard hardware wallet issue in August. That pattern is relevant beyond Bitget specifically: any Philippine or APAC operator with payment or treasury flows concentrated on a small number of centralized exchange hot wallets is carrying the same structural exposure Bitget just experienced, regardless of which specific exchange holds the balance.