Bitget hacked for $351M: how it happened and why your coins are safer in your own wallet
On September 24, about $351.6 million was drained from Bitget's hot wallets. The exchange halted withdrawals and promised to cover the loss from its protection fund. Here is how the attack worked, what it means for users, and why “not your keys, not your coins” turned out to be more than a slogan again.
What happened
On September 24 at 18:31 UTC, Bitget's security systems flagged unauthorized transfers from some of the exchange's hot and warm wallets. By the time the transfers were stopped, the attackers had moved out about $351.6 million — one of the largest attacks on a centralized exchange in 2026.
Several networks were hit at once: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base. The drained assets included XRP, BNB, AVAX, the stablecoins USDT and USDC, as well as ether, the native coin of the Ethereum network.
How the attack worked
According to Bitget CEO Gracy Chen, the wallets' private keys were not leaked. The attackers compromised the backend that manages the wallets, spoofed transaction data and triggered the regular approval process — the exchange's own system signed the transfers. The locks held; what was forged was the permission to open the vault.
Several outlets, citing researchers, link the attack to North Korean hackers. Law enforcement is investigating together with Mandiant and SlowMist.
What happens to users' funds
- Withdrawals are suspended until the security review is over, so for now you can't move coins from Bitget to your own wallet or to an instant crypto exchange.
- Trading and deposits work as usual.
- The loss is to be covered by the user protection fund, which, according to the exchange, holds more than $464 million — more than the amount stolen.
On paper, customers' money is safe. But while withdrawals are closed, nobody can take their funds off the exchange — and that is the core risk of keeping coins on someone else's balance.
What to do right now
- Don't panic-sell: trading is open and the exchange has promised to cover the loss.
- Watch out for phishing. After big hacks, scammers send emails about “compensation” and “wallet verification”. Nobody has the right to ask for your seed phrase, password or 2FA code.
- When withdrawals reopen, move long-term savings to your own wallet. An exchange is a place to trade, not to store. If you don't have a wallet yet, start with our explainer on how a non-custodial wallet differs from a custodial one.
Why it's about your own keys again
Not your keys, not your coins.
Every major exchange hack teaches the same lesson. While your coins sit on a platform's balance, their safety depends on someone else's servers, staff and approval processes. A wallet you control doesn't carry that risk: the keys are yours, and nobody can freeze your withdrawals.
If you need to not only take your coins out but also swap them, you can do it in one step. VertEXchange has no accounts and no balances: you enter your own wallet address, send your coins and receive the new ones straight to it. For example, once your stablecoins are off the exchange, you can exchange USDT TRC20 to BTC without registration and keep your reserve in bitcoin at your own address.
Swap without an account: coins land straight in your wallet, not on a platform's balance.
Swap into your own wallet
