Bitget Says Hot Wallet Transfers Exposed $351.6 Million in Assets

Bitget said unauthorized transfers from some of its hot and warm wallets affected approximately $351.6 million in assets, turning a series of unexplained onchain movements into a significant exchange security incident. The company said its cold wallets remained secure and that its User Protection Fund would cover the loss.

Transfers triggered investigation

The scale of the movement became clearer after The Block reported that more than $170 million in crypto had moved from wallets labeled as belonging to Bitget to a newly created address over roughly an hour.

The assets included ether, USDT, USDC, AVAX and BNB. The receiving address began swapping the tokens onchain, according to the report. Such activity can make it difficult to determine whether funds are being moved as part of an internal treasury operation, a wallet migration or an attack, particularly while an exchange has not yet made a public statement.

Bitget later identified the transfers as unauthorized. In its security notice, Bitget said some hot and warm wallets were affected while its cold wallets remained secure. The company did not disclose in that notice how the wallets were accessed, whether the incident involved a backend system or signing infrastructure, or whether an outside party had obtained control of transaction approvals.

The distinction between wallet types is central to the incident. Hot and warm wallets are generally used to support operational liquidity and customer withdrawals, keeping assets available for faster movement. Cold wallets are kept offline or under more restrictive controls. Bitget’s statement indicates that the unauthorized activity was contained to the more operationally exposed part of its custody structure, although the company has not yet detailed the exact number of wallets involved.

Protection fund and withdrawal controls

Bitget said its User Protection Fund held more than $464 million and would fully cover the approximately $351.6 million loss. That assurance is intended to separate the security incident from a solvency crisis, but it also raises practical questions about how the fund will be used, how quickly affected balances can be reconciled and whether the stated amount changes as investigators trace the transfers.

The exchange temporarily suspended withdrawals after detecting the activity. In a separate withdrawal notice, Bitget said deposits and trading continued while withdrawals were unavailable. It said the restriction was part of the investigation and that a full incident report would follow within 24 hours.

For users, the suspension creates a second layer of risk beyond the unauthorized transfers themselves. Even when an exchange says customer assets will be covered, withdrawal restrictions can prevent clients from moving funds during periods of uncertainty. Continued trading may preserve market access, but it does not resolve questions about account-level balances, settlement procedures or the timing of restored withdrawals.

Unanswered operational questions

The promised report will be important for assessing whether Bitget’s controls limited the damage or whether the initial estimate could change. Key issues include how quickly the exchange detected the transfers, whether transaction approvals were bypassed, how many assets were recovered and whether law enforcement or security firms can identify the recipient.

Bitget said it had engaged law enforcement and onchain security firms. Until those parties publish findings, the attacker’s identity, the precise entry point and the final recoverable amount remain unresolved. The incident therefore offers a test of exchange transparency as much as of wallet security. A protection fund may absorb the reported loss, but confidence will depend on whether Bitget can explain how liquidity left its operational wallets and what controls will prevent a repeat.