Bitget confirmed a $351.6 million security breach on Thursday and suspended withdrawals while it investigates. CEO Gracy Chen said the exchange's cold wallets remain secure and that a user protection fund covers the full loss. On-chain researchers traced part of the stolen funds to a swap into ether on Arbitrum.
Bitget lost $351.6 million to unauthorized transfers from a portion of its hot wallets on Thursday, and the exchange has suspended withdrawals while it runs a security review. CEO Gracy Chen said cold wallets remain fully secure, with only the hot and warm wallet layers affected.
According to CoinDesk, Chen said there were "unauthorized transfers from some of our hot wallets." Deposits and trading continue to operate normally, and Bitget has flagged the addresses tied to the transfers and contacted law enforcement and on-chain security firms.
On-chain trail starts at $183 million
On-chain researchers, including Arkham Intelligence analyst Emmett Gallic and pseudonymous trader DCF GOD, first flagged unusual activity late Thursday, initially reporting that roughly $183 million in assets had moved from wallets labeled as Bitget's into a single new address. A newly created wallet then spent $19.67 million in USDT0 to buy 7,111 ETH in six minutes on Arbitrum, paying up to 5% above market price through the decentralized exchanges UniswapX and 1inch Fusion. Additional wallets tagged as Bitget's sent BNB, AVAX and other tokens to the same address.
Protection fund set to cover the loss
Chen said the full amount affected falls within Bitget's User Protection Fund, which currently holds more than $464 million, and that the exchange would publish an incident report within 24 hours. That fund started at $300 million when Bitget introduced it in 2023 and has since grown.
The breach is possibly the biggest hack of 2026, a year that already saw the Liquid Network lose $320 million earlier this month. Rival exchange Bybit lost $1.4 billion in February 2025, the largest crypto theft on record, and hackers stole a combined $2.72 billion from exchanges and protocols across the industry last year.
Bitget has not disclosed how the hot wallet was compromised, saying it will not speculate on the attack vector while the investigation continues.
Sources: CoinDesk, Cointelegraph, Decrypt
Trading involves risk.
Risk Disclaimer
