Bitget Lost $351.6 million Through Its Own Signing Systems: What US Crypto Holders Should Do Now

At 18:31 UTC on September 24, 2026, Bitget detected unauthorized transfers involving approximately $351.6 million from portions of its hot and warm wallets. Withdrawals stopped; deposits and trading continued. Its official security notice said cold wallets were secure and a User Protection Fund holding more than $464 million covered the loss. Those assurances were company statements, not independently verified findings.

The Seychelles-registered exchange exposed a problem relevant to US holders even without a Bitget account: crypto held at an exchange is not an insured bank deposit. A displayed balance, a reimbursement promise, and access to withdrawals are three different things.

The exchange’s systems signed forged requests

In its September 25 explanation, Bitget said attackers compromised a backend wallet system and submitted forged transfer data through its own authorization and signing process. The company said it had ruled out private-key compromise; the initial intrusion remained under investigation. Blockhead reported Chen’s explanation. The distinction matters: protecting signing keys did not prevent the surrounding system from requesting and approving unauthorized payments.

Chen identified ETH, XRP, USDT, USDC, AVAX, BNB, and Arbitrum’s USDT0 among the affected assets. The networks included Ethereum, XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum. Cointelegraph’s account of her briefing also explained why early outside estimates were smaller: they captured the Ethereum activity rather than the full incident.

Cyber Kendra’s September 25 report described the theft as 2026’s largest. It recounted a 0.84 ETH test transfer at 18:31:11 UTC from a wallet labeled “Bitget 6,” followed by larger transfers. The attacker converted freezeable stablecoins into ETH, which has no issuer able to freeze balances. Citing Forbes, it also reported a 223 ETH outflow at 21:23 UTC, nearly three hours after detection.

Full coverage did not restore access

Bitget’s stated protection fund exceeded the disclosed loss, but a fund balance alone did not establish that customers could move their assets. The company notice still described withdrawals as temporarily suspended for a security review.

Blockhead reported that no reopening date had been announced. Chen declined to promise a window she could not guarantee. For a customer needing liquidity, continued trading inside the platform did not solve the inability to transfer funds out. Treat the reimbursement commitment and the withdrawal restriction as separate facts when assessing exposure.

What US protections actually cover

FDIC insurance does not cover this crypto loss. The FDIC’s crypto fact sheet limits deposit insurance to deposits at insured banks and savings institutions, payable when an insured institution fails. It excludes crypto assets, losses from theft or fraud, and the default, insolvency, or bankruptcy of nonbank companies, including exchanges, custodians, and wallet providers. Calling an account balance a “deposit” does not change those limits.

SIPC is not general crypto insurance. It protects eligible customer cash and securities when a SIPC-member brokerage fails financially, up to $500,000, including a $250,000 cash limit. Under SIPC’s explanation, digital assets structured as investment contracts must be registered under the Securities Act of 1933 to qualify as securities under SIPA. Unregistered investment contracts are excluded even at a member brokerage. Assets outside SIPA’s securities definition receive no protection. US residency alone creates no entitlement.

FINRA’s risk guidance states that “recovery of stolen crypto assets is rare.” It identifies reporting routes through the SEC’s tips, complaints, and referrals system, the FBI’s IC3, FINRA’s Regulatory Tip Form, and state securities regulators. Preserve account statements, transaction records, and communications about reimbursement. Reporting creates a record; it does not replace missing funds or establish insurance coverage.

The IRS question: whose loss was it?

Crypto is property for federal tax purposes under IRS Notice 2014-21. That classification does not automatically make every stolen balance deductible.

The TCJA restricted personal casualty and theft deductions under IRC §165(h)(5). The 2025 One Big Beautiful Bill Act made that restriction permanent and added qualifying state-declared disasters alongside federally declared disasters. An exchange hack does not meet that disaster exception. Section 165 separately preserves losses from transactions entered into for profit under §165(c)(2). Investment purpose is therefore central to the analysis.

The March 2025 Chief Counsel advice, CCA 202511015, examined several scams, including unauthorized account transfers. For that scenario, it looked to why the taxpayer originally held the stolen property. Assets held to generate investment income supported a profit motive. The memo does not grant every exchange customer a deduction: the taxpayer must actually suffer a qualifying theft loss, with no reasonable prospect of recovery.

The deduction is limited by adjusted cost basis under §165(b), not the stolen assets’ market value. Unrealized appreciation is not deductible. The discovery year is the starting point under §165(e), but Treasury Regulation §1.165-1(d)(3) defers a loss when a reimbursement claim has a reasonable prospect of recovery. The Form 4684 instructions explain that the potentially reimbursable portion cannot be deducted until there is reasonable certainty it cannot be recovered.

For an eligible individual investment theft loss, use Form 4684, Section B, then Schedule A to claim the itemized deduction. This is an ordinary theft loss, not a capital loss subject to the $3,000 annual net capital-loss limit. The Ponzi safe harbor under Revenue Procedure 2009-20 does not fit the described intrusion: the attackers were not operating a fraudulent investment arrangement for customers.

Bitget’s full-reimbursement commitment is the immediate obstacle to a customer deduction. If the exchange bears the loss and customers reasonably expect to be made whole, customers have no unreimbursed theft loss to claim now. Do not claim a deduction while also treating full repayment as reasonably recoverable. A withdrawal freeze by itself is not proof of a deductible loss. Preserve basis and reimbursement records before drawing a tax conclusion.

Self-custody still requires approval discipline

The separate Bitget Wallet app urged users to revoke approvals granted to its smart contracts temporarily, through Wallet > More > Approvals. Cyber Kendra reported that guidance, alongside fake “ETH,” “USDC,” and “USDT” transfers from lookalike addresses differing in their middle characters. Check entire addresses and use the app directly instead of following unsolicited recovery links.

For self-managed holdings, separate long-term cold storage from a hot wallet used for transactions. Review the permissions attached to that spending wallet. Self-custody makes authorization decisions your responsibility; it does not make every contract approval safe. Keep assets needed for ordinary expenses outside a platform whose withdrawals are suspended.

September 25’s market and regulatory backdrop

The September 25 market report placed BTC near $84,604, almost unchanged that day, despite a 5.19% 10-year Treasury yield. A steady market price did not measure an affected customer’s ability to withdraw.

In Washington, the CLARITY Act had failed its September 15 Senate cloture vote, 49–50. On September 17, the CFTC submitted “Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets” (RIN 3038-AF80) to OIRA for review under existing authority. The SEC also introduced a five-year tokenized-stock innovation exemption on September 17. Those agency actions did not make Bitget a US-registered trading venue or supply insurance for its customers.

For US holders, the practical priorities are access to funds, documented reimbursement prospects, and control over who can authorize transfers.