Bitget Finds $387.5M Gone and Starts the Review It Already Passed
Attackers spoofed transaction data and used the exchange's own sign-off to move the money out.
On September 24, 2026, Bitget found transfers it had not approved from parts of its hot and warm wallets[1]. Attackers broke into a backend system in the wallet stack. They faked transaction data and used Bitget’s own sign-off to move funds out[2]. The loss was first put at about $351,600,000, then revised to about $387,500,000 once Zcash and TRON assets were counted[3]. Withdrawals stopped and some attacker addresses were frozen. The User Protection Fund is said to cover the loss[4]. Bitget said the full amount falls inside that fund, which holds over $464 million[5].
What to do: withdrawals stay shut until the safety review is done, Bitget said. Deposits and trading stay open[6].
Who gains, who loses
Receipts
On September 24, 2026, Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure.
“At 18:31 UTC on September 24, 2026, Bitget detected unauthorized transfers from parts of its hot and warm wallet infrastructure.”
The Bitget attackers compromised a critical backend system, spoofed transaction data, and triggered Bitget’s authorization process to move funds.
“Attackers compromised a critical backend system in the wallet stack, spoofed transaction data, and triggered Bitget’s own authorization process to move funds out.”
Bitget initially estimated the loss at $351,600,000 and later revised it to $387,500,000 after Zcash and TRON assets were included.
“The loss was first put at about $351,600,000 and later revised to about $387,500,000 after Zcash and TRON assets were included.”
Bitget paused withdrawals after the incident, and its User Protection Fund was reported to cover the loss.
“Withdrawals were paused, the User Protection Fund is said to cover the loss, and some attacker addresses have been frozen.”
Bitget said user funds were covered by its User Protection Fund, which held over $464 million.
“The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million.”
Bitget said deposits and trading remained operational while withdrawals were temporarily paused pending a security review.
“Deposits and trading remain fully operational,” she said. “Withdrawals are temporarily paused and will be restored as soon as the security review is complete.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.