Bitget hack: $387.5M drained, withdrawals paused until October — why merchants shouldn't get paid on an exchange

What happened in the Bitget hack on September 24, 2026

At 18:31 UTC on Thursday, September 24, Bitget's security systems detected unauthorized transfers out of some of its hot wallets. Bitget, founded in 2018 and registered in the Seychelles, has about 120 million registered users, according to Bloomberg's report. The exchange first put the damage at $351.6 million. It later raised the figure to about $387.5 million, explaining that the first count had missed assets on Zcash and Tron, not that more money had left.

The stolen assets spanned several chains: XRP, ether, USDT, USDC, BNB, AVAX, ZEC and TRX, among others. Bloomberg reported that about $183 million was swapped into ether.

How the attack worked matters more than the size. CEO Gracy Chen told CoinDesk: "The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. Private key compromise has been ruled out." She compared it to "forged withdrawal slips through a bank's teller window."

Bitget says the breach was limited to parts of its hot and warm wallet layers and that its cold wallets are secure. Mandiant and SlowMist are helping with the investigation. Chen said the patterns were consistent with groups previously linked to North Korea, but attribution has not been confirmed. As of September 27, Bitget had not published a full technical report with a root cause.

The schedule is the story: deposits open, withdrawals closed

Bitget paused withdrawals right away. On September 26 it said it had identified and fixed the vulnerability and published a phased restart, reported by crypto.news:

Bitget says the dates depend on security checks finishing, apply to every user equally and need no action from customers. That's a reasonable way to restart after an incident. It's also a precise picture of what "funds on hold" looks like when the hold comes from a platform instead of a bank.

Throughout all of it, trading and deposits stayed open. For a trader that's a convenience. For a business that gives customers an exchange deposit address as its payment account, it means sales kept landing in a balance that couldn't leave.

Put a date on it. A shop that accepted USDC on Thursday afternoon can't move that money until Friday, October 2. September 30 and October 1 fall inside that window, and that's when rent, payroll and supplier invoices come due for a lot of small businesses.

"User funds are safe" — and still unavailable

Bitget's message to customers was clear: "User funds are safe. Your account balances are accurate and your assets are protected." The exchange says its User Protection Fund, which held more than $464 million, covers the full loss.

Take that at face value, and look at what it guarantees. It protects ownership: you'll get every unit back. It doesn't promise access: that you can pay a supplier today. A business needs both, and when something breaks they come apart.

The fund's own numbers say the rest. A $387.5 million loss is about 84% of a $464 million fund. One incident used most of the backstop. A fund like this is a promise from the same company whose systems just failed, and the next incident draws on whatever has been rebuilt by then.

None of this is special to Bitget. Any custodial platform works the same way, whether it's an exchange, a custodial processor or a card issuer: your balance is a claim on them, and their incident becomes your wait. We saw the insolvency version of this in August, when a crypto payment provider shut down overnight. This week was the security version.

How the attack worked — and the merchant version of the same trick

Chen's explanation matters well beyond Bitget. Nobody stole a key. The attacker fed the exchange's own approval system false transaction data, and the system did what it was built to do: it approved. The weak point was the message that said "this transfer is legitimate."

Merchants have a small version of the same weakness: the fake "payment sent." It can be a screenshot of a transfer, a forged confirmation email, or a spoofed request telling your store's backend an order is paid. If you release goods because of a message rather than the blockchain, you've built a small copy of the same weakness.

Two defenses cover it:

• Confirm on-chain, not on a message. A payment is real when the transfer is confirmed on the network, to your address, for the right amount. On Solana that takes about 0.4 seconds; on Base and Polygon, about two.
• Verify every notification. Payzum signs its webhooks. Your server checks the signature before it marks an order paid, so a forged "paid" call is rejected. We explain how in signed webhooks for crypto payments.

Stablecoin freezes recovered less than 1%

Circle can freeze USDC and Tether can freeze USDT; nobody can freeze ether. Around 05:00 UTC on September 25, roughly ten hours after detection, the two issuers froze a wallet holding about 218,000 USDT and 100,000 USDC. That's about $318,000, less than 1% of the loss, according to on-chain trackers cited in press reports. By then the attacker had swapped much of the stolen value into ether. Security firm MistTrack said addresses linked to the attacker still held more than 63,000 ETH.

Circle's stated policy is to freeze when it is "legally compelled by an appropriate authority," and security researchers publicly criticized how slowly it moved. For a merchant, two lessons follow:

1. Issuer freezes are a law-enforcement tool, not your recovery plan. They caught under 1% here. Plan as if a freeze won't save you.
2. The same power applies to any USDC or USDT address. For a legitimate business the practical risk is low, but it's real, which is why it pays to know who paid you and for what. We covered the freeze-and-clawback design in the U.S. Bank reversible-dollar pilot.

Why so many small businesses get paid on an exchange

Usually nobody decided it. It's a default. The owner already has an exchange account, a customer asks "can I pay in USDT?", and the quickest answer is the exchange's deposit address. It's especially common where stablecoins stand in for dollars in everyday trade. It works until it doesn't, and this week showed the ways it breaks:

1. A platform incident pauses withdrawals. This week that meant up to 7.5 days, with deposits still coming in.
2. An account review can freeze just you. Many small inflows from many different senders can look like the patterns exchange monitoring is built to flag. No hack is needed for your balance to be held.
3. Your balance is a claim, not money you hold. Protection funds and reserves decide how whole you're made, and when.
4. Nothing reconciles. Deposits arrive with no order number, invoice or customer attached. You match them by amount and time.
5. Personal accounts weren't built for business receipts. Check your exchange's terms before you run a shop through it.

What non-custodial settlement changes

Payzum is a non-custodial crypto payment processor. Each payment goes from the customer's wallet straight to a wallet the merchant controls. Payzum never holds, pools or controls the money: the settlement is the payment. Here's how that plays out against this week's events:

• No balance of yours for an attacker to drain. A breach at a processor's hot wallet can't take funds that were never in it. There's no Payzum balance holding your revenue.
• No withdrawal queue. There's nothing to withdraw. The money is in your wallet when the payment confirms.
• Payments reconcile. Every hosted checkout, payment link, invoice or POS sale is its own payment request with an amount and a status. Invoices expire and detect overpayment, and signed webhooks update your systems.
• Volatility is optional. Accept the crypto your customers hold and auto-convert to USDC or USDT if you want dollar-stable revenue.
• In-store works the same way. The Payzum POS generates a new QR for each sale. Cashiers sign in with a PIN, and you get analytics by cashier and terminal. They ring up sales; they never hold the money.

Here's the honest boundary, because non-custodial isn't magic:

• Your keys are your job. Non-custodial moves the security question from the platform to you. Keep your treasury in a hardware wallet or a multisig, keep the recovery phrase offline, and limit who can sign.
• The target moves. With non-custodial settlement, an attacker goes after where future payments land: the receiving address in your dashboard. Payzum has 2FA, encrypted secrets and a full audit log. Turn on 2FA for everyone, read the audit log, and make a small test payment after any address change.
• You'll still need an off-ramp for local currency. Payzum is crypto-only and doesn't settle to bank accounts. Treat the exchange as a door, not a vault: move only what you're converting, when you convert. More on that in non-custodial stablecoin off-ramps.

How to stop getting paid on an exchange, step by step

1. Find every place money lands. List every way a customer can pay you in crypto: deposit addresses on invoices, QR stickers, social bios, email signatures, messages to regulars.
2. Set up a wallet you control. Use a hardware wallet or multisig for the treasury. If you want a separate day-to-day receiving wallet, sweep it to the treasury on a schedule.
3. Connect it to Payzum. Turn on 2FA and choose your networks, for example stablecoins on Solana, Base, Polygon or BNB Chain. Turn on auto-convert to USDC or USDT if you want stable revenue.
4. Replace every exchange address. Online, that means payment links, hosted checkout, invoices or a drop-in plugin for your store. In person, it's the POS with a fresh QR per sale.
5. Test like a customer. Pay a small amount, check it lands in your wallet, then set up signed webhooks so orders update themselves.
6. Keep the exchange for conversion only. Convert on a schedule, move just the amount you need, and bring nothing back to sit there.

Getting paid on an exchange vs a custodial processor vs non-custodial settlement

Common objections

"My exchange is big and has an insurance fund."

Bitget is big and has one. The fund did its job, and customers still wait up to a week for some assets. Size and insurance protect ownership. They don't guarantee access on the day you need to pay someone.

"I need local currency anyway, so the money has to go to an exchange."

To convert, yes. To sit there, no. Move the amount you're converting when you convert, and keep the rest in your own wallet, in USDC or USDT if you use auto-convert. Your exposure to any one exchange drops from all your revenue to one transfer.

"Holding my own keys sounds riskier than trusting professionals."

It's a different risk, and it's one you control. This week's attack beat a professional approval system at one of the largest exchanges. A treasury wallet that isn't connected to anyone else's backend, with a hardware signer and a small, known list of signers, is a much smaller target. Take it seriously, but it's a smaller job than it sounds.