The exchange says cold storage was untouched and its $464 million protection fund covers customers, as the hack joins a string of large 2026 security failures.
Crypto exchange Bitget suffered a $351.6 million breach on Thursday after attackers made unauthorized transfers from its hot and warm wallets, prompting the platform to halt withdrawals while it investigates.
Chief Executive Gracy Chen said the attack was limited to part of the exchange's online wallet infrastructure. "Cold wallets remain fully secure," she said. "Bitget operates a three-tier wallet architecture; the breach contained only a portion of the hot wallet and warm wallet layers."
Deposits and trading continued while withdrawals were paused pending a security review.
The protection fund math
Bitget said it maintains a user protection fund of more than $464 million. On paper, that covers the loss about 1.3 times over, which is the core of the company's argument that customer balances are safe. The more important question for users is how quickly withdrawals resume, since a prolonged freeze can erode confidence faster than the loss itself.
Market impact
Bitget's own token, BGB, fell sharply on the news before partly recovering and was down 2.9% at last check. The damage stayed largely confined to Bitget's own ecosystem, with traders treating the incident as a single-platform problem rather than a systemic threat.
A pattern in 2026
The breach ranks among the largest exchange hacks of the year. Earlier in September, Liquid Network lost $320 million in a separate exploit. Two incidents of this size within a single month highlight a persistent weakness in the industry: hot wallets, which exchanges keep online to process withdrawals quickly, remain the most exposed point in their security.
Why the architecture matters
Most large exchanges split holdings into tiers. Cold wallets, kept offline, hold the bulk of assets. Hot and warm wallets hold smaller amounts needed for daily operations. Bitget's defense rests on that separation working as designed. If cold storage was truly untouched, the loss is painful but survivable. If further investigation finds a deeper compromise, the picture changes.
What to watch
The key signals are the timing of the withdrawal restart and whether Bitget draws on its protection fund to make users whole. A quick reopening with full balances would limit lasting damage. A long pause would invite the kind of outflows that turn a security incident into a liquidity problem.