Bitget confirms $351.6M hot and warm wallet drain, pauses withdrawals
By Crypto Wire
September 24, 2026
Bitget confirmed a hot-and-warm wallet breach on September 24, 2026 after unauthorized transfers hit an estimated $351.6 million, according to CEO Gracy Chen and Bitcoin.com / Bloomingbit wraps of the exchange’s security notice. Systems flagged the outflows at 18:31 UTC; Bitget says it activated emergency protocols, temporarily suspended withdrawals, and left deposits and trading running while it investigates. Cold wallets remain “fully secure,” Chen said, and the full estimated loss sits inside Bitget’s User Protection Fund, which she put above $464 million. For Rug Room, that is the unused CEX tape of the day—distinct from Payy, Meter Passport, and Duelbits stacks already filed.
What on-chain desks saw before the confirmation. Decrypt reports Bubblemaps, Arkham-linked analysts, and Emmett Gallic flagged roughly $183 million moving from Bitget-labeled wallets into a fresh address beginning 0x770b… over about an hour, with further dispersion to related destinations. Pseudonymous researcher DCF GOD highlighted a new Arbitrum wallet (0xe410…) that spent about $19.67 million in USDT0 to buy 7,111 ETH in six minutes via UniswapX and 1inch Fusion, paying up to roughly 5% over spot—classic speed-over-price laundering color. Later tagged Bitget wallets also sent ETH, AVAX, BNB, USDC, USDT, and gold-backed XAUT toward the same sink, per those wraps. Attribute the early $183 million cluster and the later company $351.6 million estimate as separate snapshots: on-chain labels versus Bitget’s internal hot/warm tally.
What Bitget is saying about user balances. Chen’s X security notice, quoted by Decrypt and Bitcoin.com, stresses that user account balances remain accurate, cold storage was not hit, and the protection fund covers the entire estimated loss. Withdrawals stay paused pending a security review; the exchange promised a fuller incident report on cause and follow-ups within 24 hours and said it will not speculate on the attack vector while the probe is open. Desk rule: publish those as company claims, not as independent proof that every customer can withdraw tomorrow or that the fund has already paid claims.
Why NFT and settlement readers still care. Centralized venues remain the on-ramp where collectors buy ETH, SOL, and stablecoins before marketplace bids. When a top-tier CEX freezes withdrawals after a nine-figure hot-wallet drain, the operational message is immediate: treat Bitget balances as frozen inventory until withdrawals reopen, move fresh NFT settlement floats only through wallets you control, and watch whether ETH bought at a premium on Arbitrum bridges into mixers or OTC desks. Leave today’s Payy bridge halt (LN 9677), Meter Passport unbacked mint (LN 9673), and Duelbits PeckShield outflows (LN 9665) closed—Bitget is a separate exchange-custody stack.
Industry context without inventing a root cause. Decrypt notes Bitget’s protection fund lineage back to a $300 million 2023 marketing figure and today’s claimed $464 million-plus balance, and reminds readers of Bybit’s $1.4 billion February 2025 cold-wallet hijack and roughly $2.72 billion stolen industry-wide last year. Those are backdrop, not proof Bitget’s access path matches Bybit’s signing-screen spoof. Until Bitget’s promised 24-hour report lands, the confirmed facts are detection time, hot/warm scope, withdrawal pause, company loss estimate, and fund-coverage claim.
What not to invent: that cold wallets were drained, that every labeled on-chain Bitget wallet equals customer liability dollar-for-dollar, that the $183 million early trace equals the final $351.6 million company figure without reconciliation, that the protection fund has already completed payouts, or that withdrawals will resume on a named clock. Stick to Chen’s notice, the attributed on-chain hops, and the temporary withdrawal freeze. Operational hygiene while the pause holds: do not send fresh NFT proceeds into Bitget deposit addresses expecting a quick exit, keep marketplace bidding wallets separate from any CEX hot float, revoke stale approvals on unrelated bridges after the alert, and wait for the official all-clear before treating Bitget withdrawals as live settlement again.
Bottom line: Bitget confirmed unauthorized hot-and-warm wallet transfers detected at 18:31 UTC on Sept. 24 totaling about $351.6 million, paused withdrawals, and said its $464 million-plus User Protection Fund covers the estimated loss while cold wallets stay secure.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
