Bitget lost $351.6 million in a hot wallet drain on September 25, 2026, the largest single crypto exchange exploit of the year, according to on-chain analytics firm Arkham Intelligence.

The exchange detected unusual outflows early Friday involving AVAX, BNB, ETH and stablecoins, all subsequently swapped into ETH. Bitget CEO Gracy Chen said the incident was contained in a hot wallet and that funds in the exchange's cold wallets remained unaffected.

How did the exchange respond?

Bitget suspended withdrawals pending a security review while keeping deposits and trading online. The firm has flagged the receiving addresses and is coordinating with law enforcement agencies and on-chain security firms to pursue recovery. Bitget expects to publish a full incident report within 24 hours.

Chen said Bitget will absorb the loss in full through its User Protection Fund, which holds more than $464 million. The reserve sits roughly $113 million above the drained amount, signaling a single-incident coverage path that does not require outside capital or additional token issuance.

The first half of 2026 had already set records for the total number of cybersecurity incidents in the crypto industry, though aggregate dollar losses ran lower than in prior years. The Bitget event, with a single-incident loss above $350 million, resets that measurement.

What is the likely intrusion vector?

Bitget has not yet disclosed whether the breach stemmed from a private-key compromise, a signer-side attack, or third-party custody of the hot wallet infrastructure. The Arkham-flagged conversion of multi-asset reserves into ETH points to a familiar post-exploit laundering pattern: compress balances into a single liquid asset before routing through mixers, DEXs or OTC desks. Stablecoins in the drain introduce a compliance angle, since issuers such as Tether and Circle maintain blacklisting powers that can freeze funds at the smart-contract level.

According to the company, customer balances on the platform's internal ledger remain intact. That claim will face independent verification once the full report releases and on-chain researchers reconcile internal accounting with on-chain flows.

Where does the loss rank in 2026?

The Bitget drain overtakes two earlier high-profile incidents of the year:

• Liquid Network exploit: $320 million
• KeloDAO hack: $292 million

It now stands as the largest single point-of-failure recorded in the digital asset industry in 2026, surpassing the prior benchmark by roughly $31 million.

What does the exchange face next?

The hot-wallet classification carries operational consequences beyond the immediate loss. Exchanges that park meaningful balances in internet-connected infrastructure face continuous exposure to key-management failures—whether through compromised signer devices, malware on operational systems, or vulnerable third-party custody integrations. Bitget's incident will likely trigger an external audit of its hot-wallet operational stack and custody provider relationships.

The 24-hour incident report, expected by late Friday UTC, must address three questions for institutional counterparties: how the signer environment was compromised, whether the drained stablecoins were blacklisted in time, and whether Bitget will adjust its hot-wallet balance policy across AVAX, BNB and ETH corridors.