Bitget Says $352M Security Incident Hit Hot Wallets; Withdrawals Paused

Crypto exchange Bitget has confirmed that it detected unauthorized transfers tied to a security breach and has temporarily suspended withdrawals while it investigates. The exchange said the incident impacted assets totaling about $351.6 million, affecting a limited set of hot-wallet holdings.

Bitget reported that its systems identified the suspicious activity at 18:31 UTC on Thursday, triggering emergency response measures. In an effort to contain the damage, the company said the breach was limited to certain hot and warm wallet layers, while cold wallets remained secure.

Key takeaways

• Bitget says unauthorized transfers impacted approximately $351.6 million and were traced to a limited number of hot wallets.
• The exchange temporarily suspended withdrawals and is conducting a security review after detecting activity at 18:31 UTC.
• CEO Gracy Chen said affected funds were primarily concentrated on Ethereum, with other networks including XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum also involved.
• Bitget stated that user balances remain accurate and that deposits and trading continue normally.
• Chen said affected assets are more than covered by Bitget’s User Protection Fund, which the exchange says holds more than $464 million.

Unauthorized transfers detected in hot-wallet layers

In a statement posted on X, Bitget said its security monitoring systems detected unauthorized transfers originating from a small number of hot wallets. The firm linked the activity to emergency response procedures initiated immediately after the alert, with the incident date and time cited as 18:31 UTC on Thursday.

Speaking directly in a live Q&A, CEO Gracy Chen emphasized that the breach was contained to a portion of the exchange’s hot and warm wallet infrastructure. She also said Bitget’s cold wallets were not compromised.

According to Chen, the stolen or affected assets included Ether (ETH), XRP (XRP), USDt (USDT), USDC (USDC), Avalanche (AVAX), BNB (BNB), and USDT0 (USDT0) on Arbitrum. She attributed the largest concentration of observed stolen funds to Ethereum.

Multiple chains involved, with Ethereum the main concentration

Chen named several networks as affected, including Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum. While Bitget highlighted Ethereum as the primary venue for the observed stolen funds, the exchange also reported activity across other ecosystems, suggesting the attacker or attackers operated across multiple wallet and chain configurations rather than a single isolated target.

Bitget’s communications also acknowledged how early onchain reporting differed from later disclosures. Chen said early onchain monitoring captured a smaller amount than what Bitget later reported because the incident extended beyond the Ethereum activity reflected in those initial traces. That distinction matters for traders and users because estimates of breach scope can change as investigators widen the analysis window and broaden the search beyond the first chain clusters detected.

Withdrawals paused; deposits and trading continue

Bitget said it has temporarily suspended withdrawals as part of its security review. Chen indicated that she expected withdrawals to resume within hours or days, framing the pause as a precaution while the exchange verifies controls and assesses the extent of the unauthorized movement.

At the same time, Bitget told users that account balances remain accurate. The exchange also said deposits and trading are operating normally, a key operational detail for customers who might otherwise anticipate a full platform halt during a security incident.

The exchange said it has flagged addresses associated with the transfers and has reached out to law enforcement as well as onchain security firms, aligning with the typical process exchanges follow in response to suspected theft—identify suspect sources, trace downstream movements, and coordinate takedown or mitigation efforts where possible.

User Protection Fund to cover affected assets

Beyond containment and monitoring, Bitget addressed customer risk directly by referencing its User Protection Fund. Chen said the affected funds are more than covered by the fund, which the exchange stated currently holds more than $464 million.

Bitget also said it would provide hourly updates to reflect its ongoing investigation. In addition, the exchange committed to publishing a full incident report within 24 hours, including a root-cause analysis and corrective actions. For users and market participants, those deliverables are especially important: a clear explanation of what allowed unauthorized transfers to occur—such as weaknesses in wallet controls, key management, operational procedures, or monitoring—can determine whether the incident is isolated or indicative of a broader systemic risk.

As the investigation progresses, readers should watch for whether Bitget’s promised incident report supports its claim that only hot and warm wallet layers were impacted, and whether the exchange’s address flagging results in measurable mitigation on-chain. The next few updates will likely clarify the exact mechanism of compromise and confirm when withdrawals resume.