Bitget's $351 Million Hack: A Crisis Response Playbook Written in Hours
What happened. On September 24, 2026, at 18:31 UTC, Bitget — one of the world's largest cryptocurrency exchanges — detected unauthorized transfers moving out of its hot wallets. Within hours, CEO Gracy Chen confirmed on X that $351.6 million had been stolen, making it the largest crypto exchange hack of 2026, ahead of the $320 million taken from the Liquid Network earlier that same month. Chen said private key theft had been ruled out: instead, the attacker compromised a backend system inside Bitget's wallet infrastructure, spoofed transaction data, and tricked the exchange's own authorization process into approving withdrawals it should have blocked. Cold wallets were untouched. A full technical report was promised within 24 hours, and by the next day some outlets were citing additional traced transactions that put the total closer to $387 million, though Bitget's own confirmed figure remained $351.6 million.
The response. Bitget suspended withdrawals “as a precautionary measure, pending security review,” while keeping deposits and trading open. Chen went live on X the same day, named the exact loss, and stated that Bitget's User Protection Fund held more than $464 million — enough to reimburse every affected user in full without touching customer deposits, with roughly $112 million left over. She said the exchange had flagged the receiving wallet addresses to blockchain-security firms and law enforcement, and pointed to North Korea's Lazarus Group as the likely attacker — a claim made publicly within a day of the breach, though independent technical evidence for that attribution had not yet been published.
The contrast — an industry that usually chooses silence. Bitget's speed stands out because the alternative is the industry's default. When India's WazirX exchange lost roughly $230 million to hackers in July 2024, it froze withdrawals and spent more than a year in Singapore-supervised restructuring before resuming operations in October 2025. Users received non-tradable “Recovery Tokens” instead of cash, and as of 2026 roughly 15% of pre-hack holdings remain locked with no guaranteed payout date. Same scale of crisis, opposite handling: one exchange left customers waiting more than a year for partial answers; the other put a number, a cause and a funding source on the table within a day.
Why this matters for reputation management. A hack is not automatically a reputational death sentence — plenty of breached exchanges survive. What decides the outcome is the first 24 hours: does leadership name the loss, name the cause, and show where the money to cover it is coming from, or does it go quiet while lawyers draft a statement? For a business whose entire product is “trust us with your money,” a slow or vague response is not a bad news cycle — it is an existential risk.
Takeaways for business owners
- Name the number before speculation does. Chen confirmed $351.6 million within hours, instead of letting early on-chain guesses define the headline.
- Show the money before you're asked. Disclosing that the reserve fund covers the loss with room to spare did more for user confidence than any apology could.
- A stated pause beats an open-ended freeze. Suspending withdrawals “pending security review” reads very differently from a freeze with no timeline, even when neither can promise an exact date.
- Silence is a choice, not a delay. WazirX users spent over a year without full answers; that vacuum — not the hack itself — is what did lasting damage to the brand.
- Don't let an unproven claim outrun the evidence. Naming a suspect builds a narrative fast, but attribution without published evidence is a reputational risk of its own if it's later walked back.
Sources: CoinDesk, CNBC, Fortune, Hackread, Insurance Journal, Wikipedia — 2024 WazirX hack
This overview was prepared by CGS.GURU. If your business needs a crisis-response plan that can hold up in the first 24 hours, not just the first press release, our team is ready to help.
