Bitget hack exposes critical response gap as $351 million drained

Bitget's security systems picked up on unauthorized wallet transfers, but the real losses started after a key half-hour window had already passed. Attackers moved fast. They pulled off two big withdrawal waves, draining more than $350 million from Bitget's hot and warm wallets. This happened even though the breach was detected early and emergency protocols were triggered. Bitget confirmed the attack began at 18:31 UTC on September 24, 2026. Only some hot and warm wallets were hit. Cold wallets stayed safe. Withdrawals were paused as a precaution.

Attack timeline and missed chance

Bitget says its systems flagged the suspicious activity at 18:31 UTC on September 24. The company claims its security team started emergency steps right away. But blockchain security firm Hypernative looked at the timeline and found the biggest outflows-$87.6 million from hot wallets at 19:01 and $202.8 million from warm wallets at 19:16-happened well after the first alert. These two bursts, finished in just 24 seconds, made up about three-quarters of the $351.6 million that Bitget and Reuters later confirmed as stolen. That number is much higher than early reports of $290 million. Bitget says its User Protection Fund, which holds over $464 million, is enough to cover the losses and pay back users.

The timeline shows a major gap between when the threat was spotted and when it was stopped. Hypernative's analysis says Bitget had about 30 minutes to block the first big outflow and 45 minutes before the largest transfer. But the compromised signing route stayed open, letting the attacker move from small test transactions to huge withdrawals across several blockchains.

How the exploit worked

Bitget's investigation found the attacker broke into a backend system in its wallet setup. By faking withdrawal data, the attacker fooled Bitget's authorization process and got fraudulent transfers approved. Bitget says private keys were not exposed and cold wallets were not touched. But the attacker's transactions were signed by Bitget's own wallets and looked almost identical to normal customer withdrawals. This made them hard to spot. During the breach, Bitget said client balances and trading stayed available, but withdrawals were paused for safety. The company also called in law enforcement and on-chain security partners to help with the investigation.

Hypernative pointed out several missed chances to stop the attack. For example, if every signed transfer had to match an independently stored customer withdrawal or treasury transaction, the attacker's route could have been blocked. The attacker's requests also used odd gas limits, which were different from Bitget's usual withdrawal process. Checking transaction details against normal patterns might have flagged the first test transfer before the big withdrawals started. Setting velocity limits-caps on how much a wallet can move in a short time-could have slowed or stopped the rapid $202.8 million outflow from warm wallets.

Security controls and aftermath

Hypernative says the biggest problem was that alerts for unusual transfers did not trigger an automatic shutdown of the affected signer. Instead, the system relied on manual action. Because of this, attacker-linked transfers kept going until 21:23 UTC, almost three hours after Bitget first detected the breach. Bitget says it has now fixed the vulnerability and that no more unauthorized transfers have happened. The forensic review is still ongoing, with Mandiant and SlowMist involved. In a later update, Bitget confirmed the flaw was found and patched, and said it would announce when withdrawals would reopen by September 26, 04:00 UTC. CEO Gracy Chen told Reuters that all user funds are safe and that Bitget is covering the losses itself. She stressed that the pause on withdrawals is just a precaution, not a sign of insolvency.

The big question is why Bitget's security response failed to stop the breach after its own systems raised the alarm. The fact that the compromised signing route stayed open long enough for over $350 million to be drained in two big waves raises serious doubts about how well the exchange's emergency protocols work.

Industry context and user impact

This hack comes after a series of major crypto security breaches, including the recent takedown of EvilTokens, an AI-driven phishing operation that targeted thousands of companies and was reported earlier by EgonCoin. The Bitget breach shows how risky backend compromise remains and how hard it is to tell fake transactions from real ones, especially when attackers use the exchange's own systems instead of outside vulnerabilities.

For users, the breach is a reminder of the risks of keeping assets on centralized exchanges. Even quick detection may not protect funds if emergency controls are slow or incomplete. Bitget's claim that private keys were not stolen may offer some comfort, but the attacker's ability to mimic normal withdrawals and get around controls points to deeper problems. As a Reuters analysis noted, Bitget's hack is now counted among the biggest crypto heists of the year. This puts more pressure on exchanges to keep upgrading their security systems.

Backend system compromise is one of the hardest attack methods for exchanges to defend against, especially when attackers can make transactions that look just like real user activity. Unlike private-key theft or front-end phishing, backend exploits can slip past many standard controls by working inside the exchange's own setup. This makes strong internal monitoring, strict transaction checks, and automated emergency controls-ones that don't rely only on people-absolutely necessary. As exchanges keep holding large amounts of digital assets, how well they protect those assets will stay a top concern for both users and regulators.