Unauthorized transfers hit the hot and warm wallet layers of Bitget at 18:31 UTC on September 24. The exchange lost approximately $351.6 million from those accounts, which led the company to immediately suspend all withdrawals as a precautionary measure. While the breach affected specific wallet tiers, Bitget CEO Gracy Chen confirmed that cold wallets remain secure, and both deposits and trading remain operational.

The company will cover the losses using its User Protection Fund, which currently holds over $464 million to ensure user balances remain accurate. On-chain data from Etherscan shows more than $180 million in ETH, stablecoins, tokenized gold, and AVAX moving to a new address tagged as "Bitget Exploiter 1." Bitget has notified law enforcement and on-chain security firms and plans to publish a full incident report within 24 hours.