Bitget Hack Fallout: The Crypto Clash Over Censorship

The Bitget hack has become the biggest crypto exchange heist of 2026 — and the fallout is exposing a fault line the industry has yet to resolve. Nearly 388 million dollars drained from the exchange's hot wallets on September 24. In the days since, Bitget's CEO has publicly demanded that a cross-chain protocol blacklist the attacker's addresses, and the protocol has flatly refused. One side calls it common sense. The other calls it the whole point of crypto.

For anyone who keeps coins on an exchange, the Bitget hack is a live lesson in who actually holds your money — and what happens when the answer isn't you. It also lands at an awkward moment: crypto adoption keeps climbing among young investors, and the exact tools they rely on are now at the center of a censorship debate playing out on public timelines.

How the Bitget Hack Went Down

According to Blockonomi's reporting, the attacker started small — two test transactions, a fraction of one ETH and a small amount of TRX, designed to slip under the exchange's risk thresholds. Then came the real strike: seventeen large withdrawals across eight blockchain networks, including Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism, and Avalanche. The exchange says it spotted the discrepancy just seven minutes after the first major withdrawal and froze all withdrawals immediately, but by then the funds were already moving.

Bitget later raised its loss estimate to roughly 387.5 million dollars after completing a full accounting, as reported by Cointelegraph. The company says private keys and cold storage remained untouched; the attacker instead exploited a zero-day flaw in third-party security software to gain administrator-level access. The exchange has hired cybersecurity firms Mandiant and SlowMist to investigate, according to CoinDesk.

Customer protection is where the company has tried to draw a clear line. Bitget says its User Protection Fund, valued at about 465 million dollars, fully covers the loss, with corporate reserves of more than 1.4 billion set to restore the fund to a 300 million dollar minimum within seven days. It also posted a bounty worth five percent of frozen funds plus five percent of recovered funds, according to Cointelegraph. And after a four-day freeze, withdrawals resumed on September 28 — 9,585 Bitcoin withdrawal orders, totaling 4,098 BTC, were processed within hours, as Blockonomi reported, while DeFiLlama tracked reserves dropping by roughly 4,642 BTC. Related reading: how Citi and Coinbase are teaming up on stablecoin payments for stores.

THORChain Said No, NEAR Said Yes

Here is where the Bitget hack story gets ideological. Once the stolen funds began flowing through permissionless cross-chain protocols, CEO Gracy Chen took to X on September 26 with a formal request: refuse service to the publicly listed attacker addresses. Her message was blunt. "Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching," she wrote, according to her public post.

THORChain's reply landed the same day — and it was also blunt. The protocol said it is decentralized and permissionless like Bitcoin and Ethereum, and asked what responsibility those networks should bear when handling known stolen funds. In short: it does not selectively censor addresses, pointing out that its emergency halt mechanism exists only to protect the protocol itself during a security event, not to freeze individual users' funds. The exchange's request landed on September 28 anyway, when the attacker converted roughly 2,390 ETH into 75.2 BTC through twenty-seven THORChain swaps, as crypto analysts tracked.

THORChain has precedent for this posture: in May 2026 it halted the entire network during a 10.7 million dollar treasury exploit but still refused to blacklist attacker addresses. Not every protocol agrees. NEAR Intents went the opposite direction, with its SHIELD system blocking more than 50 million dollars in hacker-linked swaps and freezing another 503,000 in transit, while about 166,000 slipped through, per CoinDesk and Blockonomi. NEAR even waived the bounty Bitget offered so the maximum possible funds could return. Two protocols, same stolen money, opposite philosophies.

Chen, for her part, is not holding out much hope. In an interview with Cointelegraph's Chain Reaction released September 29, she said she is not very optimistic about full recovery, pointing to the February 2025 Bybit hack, where only about 3.5 percent of the 1.5 billion dollar haul had been frozen a year later. "That's only the freezing. It's not about recovery yet," she said. Circle and Tether did cooperate — both blacklisted an attacker wallet on September 25, freezing about 318,013 dollars in USDT and USDC, according to Cointelegraph — but that was a drop in the pool.

What It Means If You Hold Crypto

Strip out the technical plumbing and the lesson is brutally simple: coins sitting on an exchange are protected by that exchange's security practices, not by blockchain magic. The hack exploited a software flaw to get admin access — not a weakness in any chain. For Gen Z investors who bought their first tokens on an app and left them there, the wake-up call is the same one every major hack delivers: self-custody, through a hardware wallet or keys you control, is the only setup where no company's security team stands between you and your money.

The censorship debate matters for the same reason. Permissionless protocols like THORChain treat every transaction identically — including a thief's — and their defenders argue that selective censorship would turn a neutral network into a committee deciding whose money moves. Critics counter that neutrality stops being neutral when the funds are publicly tracked as stolen and the protocol still processes the transfers. Both arguments are honest. Only one of them can win at the protocol level, and right now different protocols are answering differently.

What happens next in the Bitget hack is a live experiment. Bitget says it suspects the same group is behind multiple recent heists, and the industry is watching whether the 50 million dollars NEAR blocked can actually make it home. For the rest of us, the practical takeaway is closer to home: turn on every withdrawal safeguard your exchange offers, keep long-term holdings off platforms you don't need for trading, and remember that in crypto, "not your keys, not your coins" is not a slogan — it is the entire security model. You can track more developments on the Crypto topic page.