Bitget $387.5M breach: Sygnum shields institutions while retail freezes
In brief
- Bitget suffered $387.5M breach on September 24, triggering withdrawal freeze
- Retail customers faced suspension; deposits and trading continued
- Sygnum enabled Bitget institutions to trade against Swiss-held collateral
- Retail recovery depends on Bitget's insurance fund and internal systems
The Breach and the Freeze
Bitget's systems detected unauthorized transfers at 18:31 UTC on Sept. 24. The exchange's initial notice placed affected funds at approximately $351.6 million, noting that the breach reached portions of its hot and warm wallet layers while cold wallets stayed secure. In a Sept. 25 update, Bitget raised the estimated assets transferred to attacker-controlled addresses to about $387.5 million after including Zcash and TRON transfers.
Its withdrawals remained suspended in notices issued through Sept. 25, even as deposits and trading continued. Bitget said it identified and remediated the underlying vulnerability and contained the incident, with Mandiant and SlowMist assisting its investigation. The exchange promised to announce a withdrawal plan or status by Sept. 26 at 04:00 UTC.
Institutional Protection, Retail Exposure
On the day of the breach, Sygnum announced that Bitget's institutional clients could trade against collateral held at the Swiss bank instead of placing that collateral in Bitget's wallets. Sygnum's Protect service allows Bitget's institutional clients to trade spot and derivatives while pledged collateral remains in Sygnum custody in Switzerland, with Bitget mirroring the balance as trading margin.
The bank lists Bitcoin, Ethereum, stablecoins and US Treasuries among eligible collateral. Its published process requires a client to onboard with Sygnum, sign a contractual framework, open a Protect portfolio, and pledge assets before receiving exchange margin. Under Sygnum's description, the collateral is held in segregated accounts off the bank's balance sheet and is bankruptcy remote under Swiss banking law.
But retail customers got no such option. For a customer with an ordinary Bitget balance, a displayed balance and the ability to trade do not by themselves provide an exit while withdrawals are paused. Trading still depends on the exchange's order, margin, and settlement processes even when the pledged assets are held elsewhere.
The timing of Sygnum's announcement—dated Sept. 24 but not stating when Bitget client access became operational—leaves open whether the integration preceded the breach or arrived in its immediate aftermath. Either way, the contrast is clear: institutions with access to third-party custody could hedge their exposure. Everyone else waited.
Frequently asked questions
What is Sygnum's Protect service?
Protect is a custody and margin service that lets institutional traders pledge collateral (Bitcoin, Ethereum, stablecoins, or US Treasuries) to Sygnum's Swiss bank accounts while trading on connected exchanges like Bitget. The collateral stays in segregated, bankruptcy-remote accounts—not on the exchange's balance sheet.
Why does custody matter after an exchange breach?
When an exchange's hot wallets are compromised, retail traders with balances on the exchange face a withdrawal freeze and depend on the exchange's recovery fund. Institutional clients using third-party custody can continue trading because their collateral was never in the breached wallets.
