Bitget announced that it had experienced a serious breach in part of its digital wallet infrastructure, with unauthorized transfers of approximately $351.6 million. Cold wallets, according to the company, were not affected, while withdrawals were temporarily suspended.
The company detected the suspicious activity at 18:31 UTC on September 24 and immediately activated incident response protocols. In a statement that replicates Bitget’s official announcement, CEO Gracy Chen said that cold wallets remained secure.
See also: X account hack leads to fake crypto promotion
What we know about Bitget and cold wallets
Bitget operates a three-tiered architecture for storing funds. According to the company, the breach was limited to a portion of its hot and intermediate wallets, which are infrastructures used for daily operations and require more frequent communication with the network.
Cold wallets, which remain offline most of the time, were not affected, according to the same statement. Bitget also maintains that customer account balances are accurate and that user assets are protected.
The initial picture changed within hours. Early estimates from blockchain analysis firms were around $174 million, and later $183 million as new movements were detected. Bitget's final estimate is around $351.6 million.
The transfers involved different digital assets and were recorded on more than one network. This makes it difficult to directly assess the value and liquidity of each currency, as the value and liquidity of each currency are constantly changing. At the same time, public transactions allow researchers to follow the path of funds.
The practical importance of the distinction between hot and cold wallets is great. The former are associated with daily withdrawals and therefore need to be available, while the latter limit exposure by keeping most reserves offline. Protection depends not only on storage, but also on the approval processes for each transfer.
Withdrawals frozen after Bitget attack
The suspension of withdrawals is the main immediate containment measure. Bitget said that deposits and transactions remained available, but withdrawals will resume after the security check is completed. The company has identified and flagged the addresses associated with the transfers and notified authorities and blockchain analysis companies.
Chen said Bitget’s User Protection Fund has more than $464 million, which the company says covers the estimated damage. This statement is about financial coverage of the incident and does not mean that the technical investigation has been completed or that the funds have been recovered.
The withdrawal pause temporarily protects the platform from additional unauthorized transactions, but also creates practical consequences for customers. Users should not transfer money to addresses shared through unofficial channels or install applications that promise to “unlock” accounts.
See also: Alphapo hack: Are Lazarus hackers behind it?
What remains unknown in the Bitget case
It is not yet known how the attackers gained the ability to approve the transfers. It is not known whether they exploited a weakness in an internal management system, signature process, or other control mechanism. The company has committed to publishing a full report with the root cause and corrective measures.
Some reports have linked the attack to the North Korean Lazarus group, but no technical documentation has been publicly presented to confirm the attribution. HackRead's coverage notes that the connection remains under investigation and should not be treated as a definitive conclusion.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Users should avoid suspicious messages that promise instant withdrawal reinstatement or ask for recovery codes and phrases. The SecNews technical team recommends checking only from the official Bitget pages, enabling multi-factor protection, and keeping records of any transactions that seem unusual.
See also: Jewelbug operation steals government emails and sets up cryptocurrency scams
The case is a reminder that financial coverage is not enough without transparent technical information. Customers and industry professionals will expect clear timing, independent verification of movements, and specific changes to signature and verification processes.
Bitget is expected to provide further information on the resumption of withdrawals and the technical cause of the breach. The security of cold wallets remains the main conclusion of the update so far, but it does not replace the full technical report.
