The Singapore-based cryptocurrency exchange Bitget, registered in the Seychelles, confirmed a theft of digital assets totaling approximately $351.6 million. The incident occurred on September 24, 2026, primarily affecting users with hot wallets, while cold storage assets remain secure.
Unauthorized transfers were detected at 18:31 UTC. In response, the exchange suspended withdrawals, though deposits and trading remain operational. CEO Gracy Chen stated that the stolen assets include Ethereum, XRP, USDT, USDC, Avalanche, and BNB across multiple blockchain networks.
Preliminary investigations suggest the attacker accessed internal infrastructure to forge transaction data, rather than stealing private keys. Most stolen funds have been converted to Ethereum. Bitget has shared tracking data with law enforcement and blockchain analysis firms.
Bitget has pledged to fully compensate affected customers. The reimbursement will be covered by the company's User Protection Fund, which currently holds over $464 million.
