Are customer balances at Bitget safe?

Bitget says yes, on the grounds that its User Protection Fund of more than $464M exceeds the estimated $351.6M loss and that cold wallets were not affected. Balances shown in accounts are accurate per the exchange. The operational risk remains that withdrawals are paused, so users cannot move assets off the platform until Bitget lifts the freeze.

Which cryptocurrencies were stolen?

Bitget did not disclose a per-asset breakdown in its initial security notice. The full incident report, promised within 24 hours, is expected to name the affected wallets and specific tokens involved.

When will Bitget withdrawals reopen?

Bitget has not committed to a timeline. The exchange said withdrawals are suspended while its security review continues and while law enforcement and on-chain security firms investigate. A credible reopening schedule is most likely to arrive alongside the promised root-cause report.

How does this compare to past exchange hacks?

Comparisons will depend on the vector Bitget discloses. What is unusual so far is that the exchange is claiming its protection fund alone covers the entire estimated loss - a stronger initial posture than most peers took in earlier CEX breaches. Whether the claim survives the full incident report is the open question.

Bitget Confirms $351.6M Hot Wallet Breach, Halts Withdrawals as Protection Fund Absorbs Loss

Market impact

With no affected coin list disclosed in the initial notice, the immediate market read is on Bitget's own token, BGB, and on broader exchange-risk premiums across CEX-listed assets. Traders should expect wider spreads on Bitget venues until withdrawals reopen and a preference for offloading exposure to other venues at the margin. That is the standard playbook after a confirmed exchange breach and it does not require a specific catalyst beyond the withdrawal freeze itself.

The headline looks contained. The flow picture is what will decide this. Watch net inflows to Bitget in the 24 hours after withdrawals reopen - if users pull faster than they replenish, the protection-fund reassurance did not stick.

Scenarios, with invalidation:

Base case: Bitget publishes the promised root-cause report inside 24 hours, names the vector, confirms containment, and reopens withdrawals in tranches over the weekend. BGB retraces the initial drop, exchange-risk premium fades by Monday's Asia open. Invalidation: withdrawals still paused 48 hours after the notice.

Bear case: The incident report slips, the loss figure revises upward, or a second wave of unauthorized transfers surfaces before the report lands. Withdrawals stay paused into next week, BGB extends losses, and competing venues absorb volume. Invalidation: a clean, third-party-signed forensic summary published on schedule.

Bull case for Bitget specifically: The protection fund pays out in full, the vector turns out to be narrow and patched, and the transparent handling ends up cited as a template. Invalidation: any customer reports of missing balances after withdrawals reopen.

Bitget Confirms $351.6M Hot Wallet Breach, Halts Withdrawals as Protection Fund Absorbs Loss

Bitget confirmed on Saturday that attackers drained roughly $351.6 million from parts of its hot and warm wallet infrastructure, prompting the exchange to pause all withdrawals while trading and deposits continued. The Seychelles-based exchange said in a security notice that cold wallets were untouched, customer balances remain accurate, and the entire estimated loss falls within its User Protection Fund, which currently sits above $464 million. Bitget said it has flagged the abnormal transfer addresses, engaged law enforcement and on-chain security firms, and promised a full root-cause report within 24 hours.

By Rahul Mehta· AI-assisted· Altcoins & DeFi

What happened

Bitget published a security notice early Saturday saying unauthorized transfers had moved approximately $351.6 million out of parts of its hot and warm wallet infrastructure. The exchange said the incident was contained to those layers and that cold wallet holdings were not affected. Withdrawals across the platform were suspended within hours of detection. Deposits and spot and derivatives trading stayed open.

The company said it has identified and flagged the abnormal transfer addresses, engaged unnamed on-chain security firms, and contacted law enforcement. Bitget declined to speculate publicly about how the attackers got in, saying it will publish a full incident report with root-cause analysis within 24 hours. NewsBTC first reported the confirmation, citing Bitget's own support notice at bitget.com/support/articles. The separate self-custodial Bitget Wallet product was not involved, per the same notice.

Why it matters

A $351.6 million hot wallet loss is one of the larger centralized exchange breaches of this cycle, and it lands at a moment when spot flows and derivatives volume have been rotating between top-tier venues. The number itself is loud. The framing around it is louder.

Bitget's claim that its User Protection Fund holds more than $464 million puts the exchange in a position most of its peers historically could not credibly claim: that the loss can be absorbed on the balance sheet without socialized haircuts, ADL-style clawbacks, or a token-based recovery scheme. If that math holds when the incident report drops, this becomes a stress test of the protection-fund model itself. If it doesn't, the story changes fast.

The pause on withdrawals is the operational tell. As long as users cannot move assets off the platform, the incident is not closed regardless of what the balance sheet says. Every hour of paused withdrawals compounds the reputational cost, especially with deposits and trading still open, which is a configuration that tends to draw scrutiny from regulators and vocal on-chain analysts alike.

Market impact

Bitget Confirms $351.6M Hot Wallet Breach, Halts Withdrawals as Protection Fund Absorbs Loss

What happened

Why it matters

Market impact

What to watch

Disclaimer

Key takeaways

Frequently asked

Sources