Transfers triggered investigation
The scale of the movement became clearer after The Block reported that more than $170 million in crypto had moved from wallets labeled as belonging to Bitget to a newly created address over roughly an hour.
The assets included ether, USDT, USDC, AVAX and BNB. The receiving address began swapping the tokens onchain, according to the report. Such activity can make it difficult to determine whether funds are being moved as part of an internal treasury operation, a wallet migration or an attack, particularly while an exchange has not yet made a public statement.
Bitget later identified the transfers as unauthorized. In its security notice, Bitget said some hot and warm wallets were affected while its cold wallets remained secure. The company did not disclose in that notice how the wallets were accessed, whether the incident involved a backend system or signing infrastructure, or whether an outside party had obtained control of transaction approvals.
The distinction between wallet types is central to the incident. Hot and warm wallets are generally used to support operational liquidity and customer withdrawals, keeping assets available for faster movement. Cold wallets are kept offline or under more restrictive controls. Bitget’s statement indicates that the unauthorized activity was contained to the more operationally exposed part of its custody structure, although the company has not yet detailed the exact number of wallets involved.
Protection fund and withdrawal controls
Bitget said its User Protection Fund held more than $464 million and would fully cover the approximately $351.6 million loss. That assurance is intended to separate the security incident from a solvency crisis, but it also raises practical questions about how the fund will be used, how quickly affected balances can be reconciled and whether the stated amount changes as investigators trace the transfers.
The exchange temporarily suspended withdrawals after detecting the activity. In a separate withdrawal notice, Bitget said deposits and trading continued while withdrawals were unavailable. It said the restriction was part of the investigation and that a full incident report would follow within 24 hours.
For users, the suspension creates a second layer of risk beyond the unauthorized transfers themselves. Even when an exchange says customer assets will be covered, withdrawal restrictions can prevent clients from moving funds during periods of uncertainty. Continued trading may preserve market access, but it does not resolve questions about account-level balances, settlement procedures or the timing of restored withdrawals.
Unanswered operational questions
The promised report will be important for assessing whether Bitget’s controls limited the damage or whether the initial estimate could change. Key issues include how quickly the exchange detected the transfers, whether transaction approvals were bypassed, how many assets were recovered and whether law enforcement or security firms can identify the recipient.
Bitget said it had engaged law enforcement and onchain security firms. Until those parties publish findings, the attacker’s identity, the precise entry point and the final recoverable amount remain unresolved. The incident therefore offers a test of exchange transparency as much as of wallet security. A protection fund may absorb the reported loss, but confidence will depend on whether Bitget can explain how liquidity left its operational wallets and what controls will prevent a repeat.
Ethan Brooks is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Ethan Brooks's usual length and in Ethan Brooks's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Read and checked by admin on 9/29/2026
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.