Bitget's $351.6 million hack pushes September crypto losses to 2026 high

Bitget suspended withdrawals after unauthorized transfers drained about $351.6 million from a limited number of hot and warm wallets. The exchange detected the transfers at 18:31 UTC on Sept. 24. Chief Executive Officer Gracy Chen said Bitget activated its emergency response procedures within minutes. Bitget's cold wallets and most assets held on the platform were unaffected. Chen said customer balances remain accurate. Bitget's User Protection Fund currently holds more than $464 million. Chen said the fund covers the losses. Deposits and trading continue to operate normally while withdrawals remain paused for a security review. Bitget identified and flagged addresses connected to the transfers. The exchange notified law enforcement agencies and on-chain security firms. Bitget has not disclosed how the wallets were compromised. Bitget said it would not speculate on the attack vector while the investigation continues. Bitget plans to provide hourly updates. The exchange plans to publish a full incident report within 24 hours. The report will include the root cause and corrective measures. The breach occurred during Bitget's eighth-anniversary campaign. Bitget launched the campaign this month as it expands into equities, foreign exchange and other markets under its Universal Exchange strategy. DeFiLlama had recorded about $331 million in losses across 17 September incidents before the Sept. 19 Fetch.ai exploit. Subsequent attacks pushed the figure above $342 million. Most of the damage was linked to a roughly $320 million incident involving Liquid Network. Adding Bitget's $351.6 million in affected assets would push September's reported total above $684 million. That would make September the costliest month of 2026 on a gross-loss basis. September's total would surpass April's about $646.9 million in crypto exploit losses. The Drift and KelpDAO attacks accounted for roughly $577 million of April's total. The September figure could change as investigations determine whether affected assets are recovered or classified as losses. Chen said Bitget would keep withdrawals suspended until its security review is complete.