Bitget said approximately $351.6 million in assets moved through unauthorized transfers from a limited number of its hot wallets on September 24, 2026, prompting the exchange to suspend withdrawals across every listed token.

"At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," the exchange said in a statement posted at 5:34 p.m. ET. "Our security team immediately activated emergency response procedures and began a full investigation."

Chief executive Gracy Chen republished the same figures in English and Chinese on X, said updates would be issued hourly, and described the platform as running a three-tier wallet system.

How large is the exposure?

Bitget said its cold wallets and "the overwhelming majority of platform assets remain secure and unaffected." The exchange said customer account balances remain accurate and that the incident "falls within the coverage of Bitget's User Protection Fund, which currently holds more than $464 million."

The exchange has not published a token-by-token breakdown of the $351.6 million, has not named the attack vector, and has not disclosed the addresses it flagged for investigators. Bitget said it has "formally engaged law enforcement agencies and leading on-chain security partners" and will not speculate on the cause while the investigation remains open.

What does the chain show?

Wallet addresses labeled as belonging to Bitget sent roughly $165 million to a single recipient across Ethereum, Arbitrum, Optimism, and Base, according to blockchain-explorer records. Ten large transfers occurred between approximately 2:59 p.m. and 4:09 p.m. ET — beginning 28 minutes after Bitget's stated detection time and continuing for more than an hour afterward.

The receiving address on all four networks is 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. On Ethereum, Etherscan records show:

• 34.75 million USDT and 12.85 million USDC from wallet "Bitget 6"
• 3,000.32 Tether Gold tokens (≈$12.8 million) from "Bitget 5"

The seven Ethereum transfers totaled about $126 million at explorer valuations.

Arbiscan recorded 19.67 million USDT0 from Bitget 6. OP Mainnet's explorer logged 5,737.68 ETH from Bitget 5. Basescan logged 1,555.32 ETH from "Bitget 3." All three occurred at roughly 3:01 p.m. ET.

How complete is the withdrawal halt?

The suspension covers every asset Bitget lists. None of the 4,930 asset-network entries returned by its public API across 5,288 assets were marked withdrawable when checked at 5:30 p.m. and 6:05 p.m. ET. Deposits remain enabled and the ETH/USDT spot pair is online, matching the company's statement that trading continues.

The halt widened over about 75 minutes. At 4:15 p.m. ET, only Ethereum withdrawals were disabled; Arbitrum, Optimism, and Base were still listed as enabled.

Where did the funds go?

Arbiscan shows the recipient forwarded the 19.67 million USDT0 to address 0xe410a2E5710Ee787bcaa63f52A3943ff71F0d946 at roughly 3:34 p.m. ET. That secondary address held no USDT0 when an Arbitrum node was queried at 5:35 p.m. ET.

The receiving address is an externally owned account on all four networks. At 5:35 p.m. ET it held 4,596.48 ETH on Ethereum (~$12.4 million) and balances under one cent in USDT, USDC, and Tether Gold. Its ether balances on Optimism and Base stood at 0.0101 ETH and 0.0082 ETH, against the 5,737.68 ETH and 1,555.32 ETH the explorers recorded arriving earlier. The destination of the outgoing ether could not be determined.

Pseudonymous X account DCF GOD flagged the Arbitrum activity more than three hours before Bitget's statement, asking: "Think @bitget hot wallet might've just been hacked for 20M?"

What is the market impact?

BGB, Bitget's exchange token, traded at $1.98, down 2.8% over 24 hours, with a $1.38 billion market cap on $40.6 million of 24-hour volume, according to CoinGecko.

Hours before the transfers, Bitget announced it had moved institutional collateral into off-exchange custody with Swiss bank Sygnum. The arrangement covers institutional collateral, not retail balances, and follows a pattern exchanges adopt to reassure counterparties after high-profile breaches.

Bitget says it serves more than 125 million users. The reported $351.6 million would rank behind the $1.5 billion taken from Bybit in February 2025 but ahead of most documented exchange drains this year. Orionx halted withdrawals in September, and AscendEX paused automated withdrawals in July.

Withdrawals will remain off until Bitget completes the security review. The exchange has set no public deadline, leaving users unable to move assets off-platform for an indefinite window while the investigation and the address-tagging work proceed.