The Daily Ledger: 24 September 2026

Subject: Bitget lost $351.6 million out of its hot and warm wallets this evening
Preview: Withdrawals are suspended and the company says a $464 million protection fund covers it. The layer an exchange automates is the layer an attacker can reach.

THE DAILY LEDGER

24 September 2026
Bitget detects a large hot wallet breach and pauses withdrawals, bitcoin eases from its eight month high, and the CFTC spells out how crypto can serve as derivatives collateral

Editor's note: prices are CoinGecko 00:00 UTC snapshots for 24 September 2026. The exchange incident below was detected at 18:31 UTC, so this issue was closed at 21:00 UTC (23:00 Europe/Stockholm). Loss figures in an active investigation are provisional.

Bitget's security systems flagged unauthorised transfers out of its wallets at 18:31 UTC this evening, and the exchange suspended withdrawals while it investigates. The company puts the unauthorised movement at roughly $351.6 million and says its User Protection Fund, which it describes as holding over $464 million, covers the whole amount. Exchange hot wallets get drained because they are the one part of a custody stack that is designed to move money without asking a person first.

1. The Day in Numbers

• Bitcoin: $84,382 at 00:00 UTC, about 2.1 percent below Wednesday's open as the week's rally stalled.
• Ether: $2,684 at 00:00 UTC, down roughly 2.5 percent on the same basis.
• Fear and Greed Index: 71, Greed, unchanged from Wednesday.
• Bitcoin market value: $1.695 trillion at 00:00 UTC, with ether at $328 billion.

2. Why exchange hot wallets get drained

A centralised exchange does not keep customer coins in one place. It splits them across three layers that trade convenience against reach. The hot wallet holds the least and pays withdrawals automatically from keys that live on internet-connected servers. A warm layer refills it with some human approval. Cold storage holds most of the balance offline, where no software can move it without people and time.

That design means the ceiling on a breach is set by how much an exchange leaves in the automated layers, not by how large the exchange is. CoinDesk reported chief executive Gracy Chen saying user funds are safe and the loss sits inside the protection fund. Forbes put the confirmed figure at $351.6 million and noted the withdrawal freeze.

What is not yet established is the entry route. Bitget has pointed at compromised third-party security software and engaged Mandiant and SlowMist to investigate, and some reporting notes addresses and tradecraft resembling past North Korean operations. Treat attribution as an allegation until the forensic work is published. Whether a protection fund is adequate is a separate question from whether it exists, and we will come back to it.

3. Today's Headlines

The rally pauses without a catalyst

Bitcoin gave back about 2 percent from Wednesday's open and ether slightly more, with sentiment unmoved at 71. The breach landed in the evening, well after the day's decline, so the two are not the same story.

The CFTC's collateral rules are now written down

Staff guidance on how registrants may hold crypto sets a capital charge of at least 20 percent on a futures commission merchant's own bitcoin and ether positions and 2 percent on payment stablecoins, matching the SEC's broker-dealer treatment. Clearing houses may accept crypto as initial margin, firms may not invest customer money in stablecoins, and swap dealers may not post crypto as margin on uncleared swaps.

September was already the year's costliest month for theft

Before this evening, the month's largest single loss was the Liquid Network incident of 6 September, in which a flaw in the Elements codebase allowed roughly 4,000 unbacked L-BTC to be created, worth about $318.7 million. The attacker later returned 3,400 BTC. Tonight's figure is additional, and month-end tracker totals will be the number worth quoting.

4. Security Note

Tonight's incident is the note. An exchange that pauses withdrawals during an investigation is doing the right thing, and it is also the moment when fake support accounts appear offering to process your withdrawal manually. There is no manual queue. There is no priority list.

The rule: if an exchange you use halts withdrawals, do nothing through any channel that contacted you first. Read the exchange's own status page, reached by typing the address yourself, and ignore direct messages entirely. If you hold a balance there you do not need this week, this is the argument for moving it to cold storage once withdrawals reopen. Tracing stolen funds is covered in can stolen crypto be traced and recovered.

5. From the Academy Library

Exchange failure modes, reserves and the questions worth asking a custodian are in our note on proof of reserves, and the running list of this year's incidents sits on the crypto exploit tracker. New readers can start at Academy School.

No customer is reported out of pocket tonight. That is the protection fund working as advertised, and it is worth remembering that the fund is a promise from a company, not a deposit guarantee from a state.

Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.

Sources and further reading

• CoinDesk: Bitget loses $352 million in a hack and says user funds are safe
• Forbes: Bitget hack of $351.6 million triggers a withdrawal freeze
• Lowenstein Sandler: Crypto Brief, 24 September 2026, on the CFTC collateral guidance
• CoinGecko: daily price and market value snapshots used above
• Alternative.me: Fear and Greed Index