Main Takeaway: On September 24, 2026, Bitget reported about $351.6 million in unauthorized transfers from part of its hot and warm wallets. Withdrawals paused while deposits and trading continued, and Bitget says its protection fund covers the loss. Trades change an exchange's internal ledger. Withdrawals need the exchange's wallets to sign on chain.
Quick Reference
| Term | What it means here |
|---|---|
| Hot wallet | An exchange wallet whose keys sit on online systems so withdrawals can go out quickly. |
| Warm wallet | A middle layer between hot and cold storage, with more controls before funds move. |
| Internal ledger | The exchange's own record of who owns what. Trades between users update it without a blockchain transaction. |
| Authorization process | The checks a system runs before it signs and sends a transfer. |
What happened at Bitget?
Bitget says its security systems detected unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24, 2026, with about $351.6 million affected. Bitget says only part of its hot and warm wallet layers was involved and its cold wallets were not affected. Bitget suspended withdrawals pending a security review and kept deposits and trading open. Bitget says account balances are accurate.
Bitget says the loss falls within its User Protection Fund, which it describes as 5,500 BTC, about $464 million at the time, held at public addresses, and says it is working with Mandiant and SlowMist. As of 07:10 UTC on September 25, withdrawals were still paused and no restoration date had been announced. ELLIPAL has not independently verified these figures.
Why can trading continue while withdrawals are paused?
On an exchange, trading moves numbers in a ledger and withdrawing moves coins on a blockchain. When two users trade, the exchange updates both entries in its own database, and no coins move on chain. A deposit starts on chain at an address the exchange controls, then becomes a ledger credit once the exchange confirms it.
A withdrawal runs the other way. The exchange has to sign a transaction from one of its own wallets and broadcast it, and Bitget says the attack went through that signing path. Pausing withdrawals closes the outbound route while the ledger keeps working. That is how balances and trading kept running while payouts stopped.
What does "private key compromise has been ruled out" mean?
Bitget says the attacker compromised a critical backend system inside its wallet infrastructure, used it to spoof transaction data and triggered the authorization process to move funds. Bitget says private key compromise has been ruled out. On Bitget's account, the keys stayed where they were and the system deciding what they sign was fed false instructions.
The distinction applies beyond one exchange. A private key signs whatever request reaches it through an approved path. Keeping keys offline protects against theft of the key itself. Checking what a request actually does is a separate job from holding the key.
Exchange custody and self-custody, compared
Exchange custody and self-custody spread the same responsibilities in different ways. Our guide to where your crypto is actually stored covers the mechanics.
| Factor | Balance on an exchange | Coins in self-custody |
|---|---|---|
| Who holds the keys | The exchange, across its hot, warm and cold wallets | You, plus the job of keeping a backup |
| Who approves outgoing transfers | The exchange's authorization systems | You, one transaction at a time |
| If signing goes wrong | The platform can pause withdrawals and investigate | No one pauses anything for you, so a wrong approval is yours to catch |
| Loss coverage | Depends on the platform, such as a protection fund | No fund behind you, and the backup is your recovery path |
| Recovery if you lose access | The company's account recovery | Your seed phrase, if the backup reads back correctly |
| Trading | Built in, on the ledger | Coins move to a platform first |
A backup only counts if it restores. Our guide shows how to rehearse a seed phrase restore without a computer.
Which situation matches yours?
- You hold a balance on Bitget. Bitget says balances are accurate and that a withdrawal timeline will be announced once confirmed.
- You trade actively. A trading balance lives on the exchange ledger, so that portion follows the platform's schedule.
- You hold for the long term. The useful question is who approves the transfer when you move those coins.
- You already self-custody. Bitget's account separates keeping keys safe from checking what gets signed.
Where an ELLIPAL wallet fits
An ELLIPAL wallet keeps the private keys and the signing with you. Moving coins means signing a transaction yourself, so there is no withdrawal pause to wait out. Two ELLIPAL wallets fit different routines.
The ELLIPAL Titan 2.0 is a cold wallet that generates and stores private keys offline inside a secure chip. The Titan 2.0 exchanges transaction data with your phone through QR codes. No Bluetooth. No WiFi. No USB data connection.
The ELLIPAL X Card is an NFC cold wallet in card form. NFC is a short-range wireless link that works within a few centimeters. The X Card wallet is created on an offline device called the Starter, and the keys then stay inside the card's secure chip. You sign by tapping the card to your phone, and the card has no battery and no port.
Different tools. Same mission. Both wallets leave the backup and the signing with you.
Frequently Asked Questions
Does self-custody prevent this kind of loss?
Self-custody takes the exchange out of the path, so an incident in a platform's wallets does not touch coins held in your own wallet. The underlying risk stays. A person can still approve a harmful transaction, lose a backup or expose a seed phrase. Self-custody moves those checks to you rather than taking them away.
When will Bitget withdrawals reopen?
Bitget has not announced a date. CEO Gracy Chen said on September 25 that withdrawal restoration is being prepared and that a timeline will be announced once confirmed. Bitget has also said a full incident report with root cause analysis and corrective actions will follow.
How much does an ELLIPAL wallet cost?
An ELLIPAL wallet is a one-time purchase, and neither wallet needs a subscription. The official ELLIPAL store lists current prices for the ELLIPAL Titan 2.0 and the ELLIPAL X Card. Prices can change during promotions, so the store page has the current figure.
What happens if I lose my hardware wallet?
Your coins stay on the blockchain, and the seed phrase you wrote down at setup is the backup. ELLIPAL wallets use BIP39, the widely used seed phrase standard, so the phrase restores the wallet on a replacement ELLIPAL device. Our guide on losing a hardware wallet covers each step.
About ELLIPAL
ELLIPAL has been on the market since 2018, with more than 1 million users in 140+ countries. ELLIPAL wallets support 10,000+ tokens across 45+ chains and follow the BIP39 and BIP44 wallet standards.
See how the ELLIPAL Titan 2.0 and the ELLIPAL X Card work, and choose the one that fits how you hold.