Bitget said approximately $351.6 million was affected by unauthorized transfers during the September 24–25, 2026 event window, and Reuters reported that the exchange temporarily suspended withdrawals.[1] Bitquery later put the outflow higher, at roughly $387.5 million, after identifying additional Zcash and Tron transfers.[2] For readers, that leaves three distinct numbers to track: the company's initial figure, an independent on-chain estimate, and the practical effect of a withdrawal pause on anyone with funds on the exchange.
What moved and by how much
Reuters reported on September 25 that Bitget had stopped customer withdrawals after the theft, adding that the exchange said all user funds were safe and that the loss would be covered by its own funds.[1] Bitquery's investigation arrived at a higher number, about $387.5 million, and said it traced 21 transfers across eight blockchains.[2] Bitget's own support notice later said withdrawals would resume in phases starting September 28, 2026, with full restoration expected by October 2, 2026.[3]
The drivers behind it
The available reporting points to a wallet-system incident, not a broad platform outage. CNBC reported that Bitget said attackers compromised a backend wallet system, spoofed transfer information, and triggered authorization signing.[4] The Hacker News reported that Bitget said the affected funds sat in hot and warm wallets — the operational wallets exchanges use to move funds quickly — while cold wallets, kept offline and harder to reach, held most platform assets and remained secure.[5]
That distinction matters. It separates wallets used for day-to-day movement from colder custody layers meant to stay isolated from active systems. It also explains how an exchange can say user balances are intact while still pausing withdrawals during a security review.
What it changes for the reader
For anyone holding assets on a centralized exchange, the immediate change is access, not balance. A withdrawal pause affects liquidity and transfer timing even when the exchange says funds remain intact.[1][3] It's a reminder that hot-wallet exposure and withdrawal availability are separate issues — a statement about cold-wallet security doesn't by itself restore service.
- Bitget said user funds were safe and that its own funds or protection fund would cover the impact.[1][3]
- Bitquery's estimate is higher than Bitget's initial figure, so readers should treat the two totals as separate reported assessments rather than a reconciled final loss.[2]
- The incident is a case study in why exchange users should track both custody design and service status, not just headline loss figures.
What to watch
The next relevant updates are operational and evidentiary: Bitget's withdrawal schedule, any revised loss figure, and any further technical explanation of the incident.[1][3] The open question in the available material is why the company's reported total and Bitquery's estimate differ — the sources don't offer a reconciled accounting or a final independent forensic conclusion.[2][4][5]
