Bitget’s $387.5M Breach Highlights Custody Divide Between Institutional and Retail Users

Bitget disclosed that approximately $387.5 million in assets were transferred to attacker-controlled addresses during a September 24 wallet breach. Withdrawals remained suspended through September 25 notices, even as deposits and trading continued uninterrupted.

On the same day as the breach, Sygnum Bank announced that Bitget’s institutional clients could trade using collateral held at the Swiss bank rather than depositing it into Bitget’s wallets. This juxtaposition raises critical questions about off-exchange custody: which assets remain insulated from an exchange wallet breach, and what still relies on the exchange when trading or withdrawals are disrupted?

Sygnum’s Protect service is available to eligible institutional clients who complete onboarding with the bank. Neither company has disclosed how many Bitget clients use the service or whether any Sygnum-held collateral was connected to the incident.

A Breach Alongside a New Custody Route

Bitget reported that its systems detected unauthorized transfers at 18:31 UTC on September 24. The initial notice estimated affected funds at roughly $351.6 million and indicated the breach reached portions of hot and warm wallet layers, while cold wallets remained secure.

In a September 25 update, Bitget raised the estimated total to approximately $387.5 million after accounting for Zcash and TRON transfers. The exchange clarified that the revision reflected a fuller accounting rather than a fresh wave of unauthorized transfers.

Bitget stated it identified and remediated the underlying vulnerability and contained the incident, with Mandiant and SlowMist assisting the investigation. Withdrawals were temporarily unavailable, though deposits and trading stayed operational. The exchange promised to announce a withdrawal plan or status update by September 26 at 04:00 UTC.

For a customer with an ordinary Bitget balance, a displayed balance and the ability to trade do not by themselves provide an exit while withdrawals are paused.

Sygnum explained that Bitget’s institutional clients can use its Protect service for spot and derivatives trading while pledged collateral remains in Sygnum custody in Switzerland. Bitget mirrors the balance as trading margin. Eligible collateral includes Bitcoin, Ethereum, stablecoins, and U.S. Treasuries. The published process requires a client to onboard with Sygnum, sign a contractual framework, open a Protect portfolio, and pledge assets before receiving exchange margin.

Under Sygnum’s description, the collateral is held in segregated accounts off the bank’s balance sheet and is bankruptcy-remote under Swiss banking law. Keeping pledged assets at the bank reduces direct custody exposure to Bitget’s own wallets. The arrangement also addresses the concern that if an exchange faces financial distress, the collateral is intended to remain outside its estate.

The announcement is dated September 24 but does not state when Bitget client access became operational, nor whether the integration preceded the 18:31 UTC breach or arose in response to it. It does not identify any Bitget client who had completed onboarding, provide a Bitget-specific collateral balance, or confirm whether Sygnum-held assets were involved in the incident. Figures in the release for Protect’s total assets and the trading-volume share of all integrated exchanges do not measure Bitget client uptake.

The Limits of Custody and a Separate Backstop

Protect’s public page advertises flexible collateral top-ups and withdrawals. It does not publish the Bitget-specific contract that would determine when pledged assets can be released, how positions are settled, or what happens to margin if Bitget pauses its withdrawal service.

A trading balance mirrored at an exchange is also not the same thing as an ordinary customer’s withdrawable exchange balance. Trading still depends on the exchange’s order, margin, and settlement processes even when pledged assets are held elsewhere. Segregated custody can reduce exposure to theft from Bitget-held wallets and to Bitget insolvency, as Sygnum describes.

The public materials do not establish that a Protect client can instantly reclaim pledged collateral during an exchange disruption, or that an exchange’s operational problems could never delay settlement. They equally do not show that any Sygnum client is blocked from its collateral in this incident. The arrangement creates an optional boundary between institutional collateral and Bitget wallet custody.

For users holding assets on Bitget, the exchange pointed to its User Protection Fund. In its initial September 24 notice, Bitget said the fund was worth more than $464 million and that the then-estimated $351.6 million incident fell within its coverage. The fund’s public page lists 5,500 BTC and states users may claim for qualifying losses from platform-wide events beyond their own actions or trading behavior, with Bitget reserving the right to assess and investigate claims.

The dollar value of a Bitcoin-denominated fund moves with Bitcoin’s price. Bitget’s August report put the fund’s monthly average at $382 million and its month-end value near $432 million on the same 5,500 BTC holding.

Bitget also said it froze some affected assets through work with industry partners, though its September 25 update did not quantify the frozen or recovered amount. The next measurable tests are a confirmed withdrawal timetable, a firmer loss and recovery accounting, and the terms of any fund disbursement.

For the custody comparison, the missing facts remain Bitget-specific Protect uptake and the contract governing collateral release and settlement when the exchange is under strain.

Source link