I’ve been watching the Bitget breach, and one detail stands out to me:
This was not simply a “hot wallet got hacked” story.
Bitget says around $387.5M was transferred to attacker-controlled addresses, with the figure revised after a fuller on-chain accounting. The exchange says its cold wallets and private keys were not compromised.
But here is the difficult part:
Once crypto leaves an exchange wallet, recovery becomes a race against the blockchain.
Bitget has launched a bounty and is working with other companies to freeze funds. Tether and Circle reportedly blacklisted a linked wallet, while NEAR Intents said it blocked more than $50M in assets connected to the attack.
And Bitget CEO Gracy Chen is openly cautious about full recovery, using the 2025 Bybit hack as a reference.
That matters.
How do other exchanges approach this?
Binance:
During its 2019 security incident, Binance suspended deposits and withdrawals, investigated the entire system and said its SAFU fund would cover the loss so users would not be affected.
Kraken:
Kraken uses withdrawal holds and restrictions when transactions trigger security concerns. Its current documentation explicitly notes that crypto withdrawals are irreversible and may be held for review.
So the real security question for any exchange isn't:
“Can hackers get in?
No system can honestly promise zero risk.
The better questions are:
• How quickly can abnormal withdrawals be detected?
• Can large transfers require independent approval?
• How much liquidity sits in hot wallets?
• How fast can withdrawals be frozen?
• Is there a transparent user-protection reserve?
• Can stablecoin issuers and other platforms help freeze stolen assets?
• What happens when the attacker uses multiple chains?
The Bitget case also shows why small test transactions and withdrawal-risk thresholds matter. Reports say the attacker first tested small transfers before the much larger drain.
For me, this is bigger than Bitget.
Exchange security is becoming part of crypto market structure itself.
Your trading fee can be 0.1%.
But if the withdrawal-control layer fails, the number that matters is 100% of your balance.
Not your keys.
Not your leverage.
Not your entry.
Your ability to withdraw.
