Bitget Hacked for $351.6 Million: The Exchange Says User Funds Are Safe — and September Is Now 2026's Costliest Hack Month
The eighth-anniversary party was still on when the gift arrived: $351.6 million walked out the door. Bitget taught the whole industry a lesson this week — an exchange's "asset security" is only ever one 18:31 away from its expiration date.
Three key facts
At 18:31 UTC on September 24, Bitget detected unauthorized transfers from its hot and warm wallets: fifteen transactions across seven assets drained nearly $192 million (Ethereum accounted for 44.4%), with total affected assets confirmed at roughly $351.6 million. The exchange triggered emergency procedures within minutes; cold wallets and the bulk of platform assets were untouched. All withdrawals were paused while deposits and trading continued. CEO Gracy Chen promised a full incident report with root-cause analysis within 24 hours, plus hourly updates.
The backstop claim is bold: Chen said the entire loss falls within the coverage of Bitget's User Protection Fund — which currently holds more than $464 million — and that customer balances were not off by a cent. The attack method remains undisclosed; the official line is "no speculation on the attack vector while the investigation is ongoing." Connected addresses have been flagged, and law enforcement and on-chain security firms notified.
The breach makes September 2026's most expensive hack month: DeFiLlama had already logged over $342 million in September losses (the bulk being Liquid Network's ~$320 million sidechain incident); adding Bitget's $351.6 million pushes the month past $684 million — above April's $646.9 million, when Drift and KelpDAO alone accounted for ~$577 million.
Wang Dou's Take
"User funds are safe" — every exchange says it after getting robbed; the only difference is what they produce afterward as proof. Bitget at least put the proof on the table: a $464 million protection fund against a $351.6 million hole, a coverage ratio of 132%. That's the confidence behind freezing withdrawals within minutes and taking its sweet time on the security review. Compared with peers whose funds have run dry and who fall back on "installment compensation" stalling tactics, the depth of the reserve is the exchange's real product.
But don't let "no user harm" set the tempo. Fifteen transfers walked out of hot and warm wallets in one sitting — the attacker wasn't passing by to pick pockets; they had the keys and moved at leisure inside. A response measured in minutes still loses to an insider or a key leak that arrived with homework done. Until the root-cause report lands, every "secure" narrative is just a stay of execution.
The number worth remembering is the monthly ledger: $684 million in September — half a unicorn stolen in thirty days. That's the cruelty of on-chain security: defenders must hold every door; attackers need to find one. The exchange arms race has run for a decade, protection funds keep growing, and the hackers' monthly KPI keeps setting records. Money can be repaid; trust can't survive a second miss. This time the fund absorbed the blow. The day it can't is the date that actually gets written into history.
Source: CryptoSlate · CoinDesk · Forbes