Summary of the $351 million Bitget hack: Are user funds actually safe, and the lessons to be learned

This morning is likely another one that has left cryptocurrency market investors feeling a jolt of shock.

When a global exchange like Bitget experiences a major security incident, resulting in over $351.6 million USD—or more than 11 billion Thai baht—in digital assets flowing out of the system.

This incident not only sent a severe shockwave through the market but also led to the emergency measure every investor fears most: "the announcement of a temporary withdrawal suspension."

The crucial question that I believe rushed into everyone's minds the moment they saw this news is: Are the funds we keep on exchanges really safe, and if this were to happen to an exchange we use regularly, what should we do?

Today, I will take you through the facts of this incident, deconstruct the internal operations of exchanges, and explore ways to protect our assets from becoming future liquidity hostages.

What happened to Bitget today? A timeline summary of the 11-billion-baht hot wallet hack

Looking back at late last night, blockchain transaction monitoring tools began detecting anomalies. There was a continuous transfer of massive assets from Bitget’s wallets to mysterious addresses.

According to Forbes: Bitget Hack Of $351.6 Million Triggers A Withdrawal Freeze and CryptoSlate: Bitget's $351.6 million hack pushes September crypto losses to 2026 high, it is confirmed that the net loss is approximately $351.6 million USD.

This figure of loss has caused crypto attack statistics for September 2026 to soar to their highest level of the year immediately.

Backend compromise through unauthorized withdrawal requests

Many may be worried about whether this incident was caused by a leakage of master keys or private keys.

Bitget and on-chain security analysts have provided preliminary information that the system's private keys were not directly compromised, which avoids the worst-case scenario.

However, what happened is that the attackers were able to breach the backend management infrastructure responsible for maintaining the wallet service system.

Once the hackers gained administrative rights, they "faked withdrawal requests" and ordered the system to authorize the release of coins from the wallet as if they were standard customer requests.

Liquidating coins and rushing to swap into Ethereum

The attackers' behavior in this incident is quite interesting because most of the assets stolen were stablecoins like USDT and USDC, as well as gold-backed tokens like XAUT.

These coins have a weakness for hackers: the central issuers can blacklist wallet addresses or suspend transactions if they are found to be linked to theft.

The criminals didn't wait; they rushed to dump these coins on Uniswap across multiple blockchains, including Ethereum, BNB Chain, and Avalanche, accepting prices significantly lower than the market rate to immediately convert all assets into over 24,590 ETH.

Because ETH is a coin on a decentralized blockchain network, no one or no company can press a button to stop transactions.

Who is affected by this incident? Are user funds truly safe, or is it just an illusion?

Shortly after the incident, Gracy Chen, CEO of Bitget, quickly clarified on social media, with the key message intended to reassure investors that "user funds are safe."

However, in the reality of the financial world, there are dimensions of impact that you need to look deeper into than just the numbers on an application.

The $464 million protection fund: A safety net gained at the cost of high tension

Bitget confirmed that the total loss of $351.6 million is covered by the Bitget User Protection Fund, which has a remaining reserve value of approximately $464 million USD, according to reports from Mitrade.

In accounting terms, that means user principal will be compensated, and the balance in your portfolio won't just disappear.

However, if we calculate the math directly, this loss consumed 75.77% of the protection fund, or nearly 3 out of every 4 dollars in the entire fund.

This means the platform's "safety buffer" has become significantly thinner. If a repeat crisis were to occur or the crypto market were to undergo a severe correction resulting in a drop in the fund's asset value, this safety zone would instantly become very fragile.

Real-world impact: Sudden withdrawal suspensions and lessons on digital balances

Even if executives say funds are safe, the first thing that actually happens to all users is a "Withdrawal Freeze."

Imagine, if you will, that you have a deposit at a bank, and one day the bank locks its doors, telling you your money is still there, but you are now forbidden from withdrawing, transferring, or moving it anywhere at all.

In practice, we have already lost "sovereignty over our assets."

The groups of people hit hardest in such a situation include:

Why are Hot Wallets such popular targets for hackers?

To help you better understand the big picture, the admin would like to explain how exchanges store coins using a simple comparison.

When we open an account with a crypto exchange, the platform always divides asset storage into two main parts.

1. Hot Wallet: Like the change in a store drawer

A Hot Wallet is a digital wallet connected to the internet and blockchain networks 24/7.

Its purpose is to act as "front-store cash" to provide quick, automated deposit and withdrawal services for customers.

The advantage is convenience and speed, but the disadvantage is that it is like a large target constantly open to the outside world. If there is a single vulnerability in the backend system or API, hackers can reach in and snatch the money from this drawer instantly.

2. Cold Storage: Like an underground safe cut off from the outside world

Cold Storage, or a Cold Wallet, is an asset storage system completely disconnected from the internet (air-gapped).

This type of wallet is used to store the majority of customer and company assets. Signing each transaction requires multiple parties to verify it using hardware devices.

In this incident, Bitget has confirmed that the assets in Cold Storage remain 100% safe.

However, the issue that the crypto community on Reddit is heavily questioning is why a global exchange would allow over $350 million to remain in Hot and Warm Wallets, ultimately becoming a major prize for hackers.

Risk Comparison Table: Depositing on an Exchange vs. Self-Custody with a Hardware Wallet

Context for Thai Investors: Closer to Home Than You Think

For Thai investors, there is one more critical fact to always be aware of.

Bitget has been listed on the Thai SEC's Investor Alert list since May 2023 for operating as a digital asset business without a Thai license.

This means that if a severe incident occurs where a foreign exchange goes bankrupt or cannot compensate for damages—similar to past cases like WazirX or FTX—

Thai investors will have no legal recourse through domestic mechanisms, and cross-border litigation is virtually impossible for retail investors.

Practices for Investors: How to manage your portfolio without having to worry when an exchange is hacked

I am not saying we should stop using exchanges entirely, as they remain essential bridges for exchanging Thai Baht for crypto.

But what we must change is our "storage behavior" so that our portfolios are not subjected to unnecessary risks.

The 80/20 Rule for Asset Storage

A simple, widely recommended principle I would like to suggest is the 80/20 rule.

If you have not yet studied storage devices, I recommend reading our foundation articles, "What is a Hardware Wallet and Why is it Important?" and the guide "How to Choose a Hardware Wallet for Beginners" to understand before making a decision.

And when you are ready to withdraw your coins, it is crucial to verify the correct network for the transfer to prevent your coins from being lost in transit. You can learn more from our guide, How to Transfer Bitcoin and Crypto via the Correct Network: A Beginner's Guide.

Summary

The Bitget hack today serves as another major wake-up call for the year.

It underscores the reality that no matter how large an exchange is or how massive its reserve funds may be, as long as assets are centralized, that point remains a target for attack.

The core purpose for which Satoshi Nakamoto created Bitcoin was not for us to deposit our money into the safes of new financial institutions.

It was to return power and financial sovereignty to the hands of all of us.

The saying "Not Your Keys, Not Your Coins" is not a threat; it is a fundamental truth that has been proven time and again in every crisis.

What are your thoughts on this Bitget hack? Is anyone currently experiencing issues with withdrawals, or have you started planning to move your coins to self-custody? Let’s share your opinions in the comments!

If you are looking to level up your portfolio security or want to consult on choosing an authentic hardware wallet that fits your investment style, feel free to contact our team via LINE OA: @bitcast, or browse our models at Bitcast Collections.

// Admin Tee

Frequently Asked Questions (FAQ)

Q1: Does this Bitget hot wallet hack directly affect the funds of general users?

In terms of account balances, Bitget has confirmed that user funds were not lost and are fully covered by the User Protection Fund. However, all users were indirectly affected by the temporary suspension of withdrawals, which prevented them from moving or accessing their assets immediately.

Q2: How are exchange hot wallets different from personal mobile wallet apps like Bitget Wallet or MetaMask?

The difference lies in key ownership. Exchange hot wallets are "centralized custodial" wallets where the platform controls the keys and the backend systems. In contrast, apps like Bitget Wallet or MetaMask are "non-custodial" wallets where users hold their own seed phrase and have the right to authorize transactions themselves.

Q3: Is it safer to keep coins on a Thai SEC-licensed exchange?

It is safer in terms of legal and regulatory standards. The Thai SEC requires exchanges to strictly segregate customer assets from company accounts and maintain at least 90% of assets in cold storage. Additionally, if issues arise, there are legal channels for complaints and protection under Thai law. However, in terms of technical risk, depositing assets with a third party still carries the risk of withdrawals being halted during a crisis.

Q4: At what crypto portfolio size should I start moving coins to a hardware wallet?

A general rule of thumb is that if your crypto asset value exceeds the price of a hardware wallet (approx. 3,000–5,000 THB), or if it is a savings amount you intend to hold long-term and would find unacceptable to lose, that is the best time to start moving your coins into your own custody.

Q5: If an exchange I use suddenly announces a suspension of withdrawals, what can I do?

What you can do immediately is follow the official announcements and communication channels of the platform closely. Avoid clicking on phishing links or sending passwords to anyone posing as support. Take screenshots of your transaction history and account balance as evidence, and once the system allows withdrawals again, consider moving your main assets to a personal wallet immediately to mitigate risk.