Bitget says its User Protection Fund can cover about $351.6 million in losses linked to a security incident. The exchange reported unauthorized transfers from some hot wallets on September 24, 2026. The company said its security systems detected the transfers at 18:31 UTC. It then activated its emergency response procedures within minutes. The incident affected a limited part of its hot and warm wallet infrastructure.
According to the exchange, its cold wallets remain secure. It also said most assets held on the platform were unaffected. The company stated that customer account balances remain accurate.
Protection Fund to Cover Losses
Bitget said the affected amount is estimated at approximately $351.6 million. The exchange said its User Protection Fund currently holds more than $464 million. The company said the fund is sufficient to cover the reported loss. This means the affected amount falls within the fund’s stated coverage. The protection fund was created in 2022. Bitget initially launched it with $300 million in assets. The company has continued publishing regular fund valuation reports.
Its August report showed an average monthly valuation of $382 million. The fund reached more than $441 million at its highest point that month.
Withdrawals Temporarily Suspended
Following the incident, Bitget temporarily suspended cryptocurrency withdrawals. The move was described as a precaution while security checks continue. Deposits and trading remain operational, according to the exchange. Bitget said withdrawals will resume after the security review is completed. The company also identified and flagged addresses connected with the unauthorized transfers. It has notified law enforcement agencies about the incident.
Bitget said it is working with on-chain security companies during the investigation. The exchange also plans to provide further updates through its official channels.
Investigation Into the Security Incident
The exact attack method was initially not confirmed by the exchange. Bitget said it would avoid speculation while the investigation continues. Later reporting cited comments from CEO Gracy Chen about the incident. Chen said the attackers compromised a critical backend system within the wallet infrastructure. She said the attackers used spoofed transaction data to trigger the authorization process. Chen also said private keys were not compromised. The company said it plans to publish a detailed incident report. The report is expected to include a root-cause analysis and corrective measures.
The security incident has drawn attention to the risks facing cryptocurrency exchanges. Hot wallets are connected to systems that support regular transactions. This makes their security an important part of exchange operations. For now, Bitget says customer assets remain protected. The exchange continues its investigation while withdrawals remain temporarily paused.
Read more about Crypto platform mistakenly sends $40bn worth of bitcoin to users and the details behind the major Bitcoin transaction error.