2026-10-30
Bitget crypto theft (about US$387.5 million): are customer balances covered, and what account holders should do
On September 24, 2026 (UTC), the crypto exchange Bitget detected unauthorized transfers from part of its hot and warm wallets. It first estimated about US$351.6 million and on September 25 confirmed about US$387.5 million sent to attacker-controlled addresses. Bitget says customer account balances were not affected, that the loss falls within its User Protection Fund, that cold wallets were not touched, and that the entry point was a zero-day vulnerability in third-party security products, now remediated. Withdrawals were paused, then restored in phases; Bitget's page says they were fully restored on October 2. Bitget has not published the name of the affected product or a full root-cause report. This site's take: this was a theft from the exchange's own wallets, not a leak of customer data, so the main risk for account holders now is fake 'recovery' and 'compensation' messages. Turn on two-factor authentication, open Bitget only from your own bookmark, and never share a seed phrase, private key or verification code.