Bitget Loses $351.6M From Hot Wallets, Withdrawals Frozen
Bitget's hot wallets bled roughly $351.6 million on September 24, and the Seychelles-based exchange has paused withdrawals while it investigates. It's the third nine-figure crypto security failure this year, and it lands right as Hong Kong tightens its custody standards.
$351.6 million walked out of Bitget's hot wallets on September 24, and the exchange's own systems didn't flag it until 18:31 UTC.
CEO Gracy Chen confirmed the unauthorized transfers the same day. "Our security team activated emergency response protocols immediately," she wrote. Deposits and trading kept running. Withdrawals are frozen until a security review wraps up. Cold wallets, she says, stayed clean, and the damage was contained to parts of the hot and warm wallet layers inside the exchange's three-tier setup.
Bitget is based in Victoria, Seychelles, and ranks sixth among exchanges with more than $1.1 billion in daily volume. That's not a small platform. Arkham Intelligence stood up a dashboard within hours and showed stablecoins plus a mix of other tokens leaving the hot wallet. Hacken went further, saying bitcoin moved too, which Arkham's list didn't capture.
The 2026 pattern is what worries me. July brought the Coldcard firmware exploit, roughly $120 million gone from user funds. Earlier this month, about 4,000 bitcoins, close to $320 million at the time, left Blockstream's Liquid federation wallet. Three nine-figure hits in one year isn't bad luck. It's a custody model failing in the same spot over and over.
Hot wallets exist because traders hate waiting. Fast withdrawals require funds sitting online, and online funds require keys someone can reach. That's a business decision, and offshore venues have historically accepted it because the licensing bar is lower where they're registered. The licensing race in Hong Kong is accelerating precisely because of incidents like this one. Regulated venues in Tokyo and Seoul are writing rules that shrink hot wallet exposure and force faster disclosure, and that's the pitch they'll run against Seychelles-based competitors for the rest of the year.
The capital isn't leaving crypto. It's leaving your jurisdiction.
Here's the number to watch. If Bitget clears its withdrawal queue inside 48 hours, this is a bad week. If it drags past that, the volume doesn't disappear. It goes somewhere with a license.