Bitget disclosed that approximately $387.5 million in assets were transferred to attacker-controlled addresses during a wallet breach detected on September 24 at 18:31 UTC. The exchange suspended withdrawals but kept deposits and trading operational, with Bitget stating it identified and remediated the underlying vulnerability. Mandiant and SlowMist assisted the investigation.
The breach coincided with an announcement from Sygnum, a Swiss bank, that Bitget's institutional clients could use its Protect service to trade against collateral held in custody at the bank rather than placing assets directly in Bitget's wallets.
Two-Tier Structure for Institutional and Retail Users
Under Sygnum's Protect service, eligible institutional clients can pledge collateral including Bitcoin, Ethereum, stablecoins, and US Treasuries. These assets remain in segregated accounts held off the bank's balance sheet and designated as bankruptcy remote under Swiss banking law. Bitget mirrors the balance as trading margin for spot and derivatives trading.
Retail users holding ordinary Bitget balances faced direct exchange wallet exposure during the breach. Bitget pointed to its User Protection Fund, which the exchange valued at more than $464 million at the time of the incident, stating the estimated $351.6 million initial loss figure fell within coverage.
Unresolved Details on Custody and Recovery
Several key facts remain undisclosed. Bitget and Sygnum have not stated how many Bitget clients use the Protect service, whether any Sygnum-held collateral was connected to the incident, or when client access to the custody integration became operational. The exchange's public materials also do not establish whether Protect clients can instantly reclaim pledged collateral during an exchange disruption or what contract terms govern collateral release and settlement when the exchange faces operational strain.
Bitget said it froze some affected assets through work with industry partners but did not quantify the frozen or recovered amount. The exchange promised to announce a withdrawal plan or status by September 26 at 04:00 UTC. Subsequent measures will include a confirmed withdrawal timetable, a firmer accounting of losses and recovery, and the disclosed terms of any fund disbursement.
