Bitget Froze Withdrawals. Its Self-Custodial Wallet Didn't Skip a Beat

Developing story. Details below reflect Bitget's own statements and reporting as of the evening of 24 September 2026. Bitget's official channels are the authoritative source for anything affecting your account, and figures may be revised.

At 18:31 UTC today, Bitget's security systems detected unauthorised transfers from some of its hot wallets. By 21:30 UTC, chief executive Gracy Chen had confirmed it publicly. Roughly $351.6 million is gone, and customer withdrawals are suspended while the exchange investigates.

It is among the largest exchange breaches since Bybit lost about $1.4 billion to the Lazarus Group in February 2025.

The detail almost everyone will miss

In July we wrote about Bitget Wallet crossing 100 million users, and about daily payment users outnumbering traders for the first time. That product is self-custodial — keys held by the user, funds never on Bitget's balance sheet.

Today's breach hit Bitget the exchange — the custodial business. Same brand. Same company. Two completely different products, and only one of them can freeze your withdrawals, because only one of them ever had your coins.

You could not ask for a cleaner controlled experiment. Identical operator, identical security team, identical jurisdiction, identical incentives. The difference in outcome is entirely structural: an attacker who compromises wallet infrastructure can take what the company holds, and nothing else. Self-custodial users of the same brand woke up to a news story rather than a frozen balance.

If you have funds on Bitget

• You currently cannot withdraw. That is the situation, and no amount of urgency changes it. Watch Bitget's official channels for when withdrawals resume.
• Do not trust anyone who contacts you. A breach with frozen withdrawals is the single highest-value moment in the year for phishing. There is no priority withdrawal service, no recovery agent, no support representative who needs your seed phrase or your login. Anyone offering help first is stealing.
• Be sceptical of unofficial "updates." Fake announcement accounts proliferate within hours of events like this. Go to the source directly rather than following links.
• Don't deposit more. Obvious, but people do it — attempting to average down or move funds around inside a platform mid-incident.
• Download your transaction history when access permits, for tax and record purposes.

What we don't know, and won't pretend to

Bitget has not said how the attackers got in. Forbes' coverage noted, correctly, that breaches of this shape rarely involve breaking cryptography — they involve credentials, infrastructure, or people. Beyond that, speculation is worthless and attribution this early is usually wrong.

We also don't know whether customer funds are ultimately at risk. A $351.6 million loss at an exchange of Bitget's size may well be absorbable from company reserves, as several large exchanges have done before. Nothing here should be read as suggesting Bitget is insolvent. The suspension of withdrawals is a standard protective measure during an active incident, not in itself evidence of a shortfall.

Credit where it's due, too: detection to public confirmation took about three hours. That is fast, and it is better than the industry norm of learning about a breach from a blockchain analyst on social media.

The lesson, stated without triumph

We have written this argument all year — AscendEX dying with user funds inside, BitMEX and BitMart scheduling their own shutdowns, a breach that exposed identities rather than coins — and there is no satisfaction in another example arriving. People with money on Bitget tonight are having a bad night, and "you should have self-custodied" is useless to them.

What is worth saying is the narrow, structural version: custodial risk is not a claim about a company's competence. Bitget is a large, well-resourced exchange with a serious security team, and its own self-custodial product is untouched tonight. The exposure came from the arrangement, not the operator. Any platform that holds your coins can be compromised, can freeze withdrawals while it investigates, and can make you wait on a timeline you have no say in. Good ones make that rare. None make it impossible.

The reason this site exists is the other arrangement. TokensFund never holds your funds: swaps route from your wallet, through THORChain, Chainflip, Changee or CCE.Cash, to an address you control — no account, no KYC for standard swaps, flat 1% inside the quote. There is no balance of yours for us to freeze, because there is never a balance of yours here at all. That design doesn't make you safe from everything. It makes you safe from tonight.

A note on risk

Nothing here is financial advice. This is a developing incident; figures, causes and consequences may change, and Bitget's own communications are authoritative. No allegation of wrongdoing, negligence or insolvency is made against Bitget. Self-custody transfers risk to you rather than removing it — back up your keys, verify addresses, and send test amounts.