Your Crypto Can Be Safe While the Platform Holding It Is Under Attack

There is a familiar checklist for staying safe in crypto.

Keep your password private. Protect your seed phrase. Turn on two-factor authentication. Never share your private keys.

All good advice.

But the latest security breach at cryptocurrency exchange Bitget has added another question to that list: How secure is the infrastructure behind the platform holding or moving your assets?

On September 24, Bitget detected unauthorised transfers from parts of its hot and warm wallet infrastructure. The exchange initially estimated the affected assets at about $351.6 million before revising the figure to approximately $387.5 million after further analysis of transactions across several networks.

The incident did not involve Bitget's cold wallets, according to the exchange, and its investigation found no compromise of private keys. Bitget also said its separate self-custodial Bitget Wallet product was not affected.

This actually matters because it tells us something important about how crypto platforms work.

The blockchain was not the only place to look

When people hear that hundreds of millions of dollars worth of cryptocurrency have been stolen, it is easy to imagine someone somehow breaking the blockchain itself.

That is not what happened here.

According to Bitget's investigation, the attackers exploited a vulnerability involving a third-party security product to obtain internal access credentials. They then used that access to forge withdrawal commands and manipulate the exchange's wallet infrastructure, causing unauthorised transfers to be executed. Bitget says the underlying vulnerability has since been identified and remediated.

In simple terms, the weakness was not necessarily in the blockchain.

It was in the machinery around it.

Think of a bank with a heavily secured vault. The vault may be difficult to break into, but the people and systems controlling access to it still need to be protected. If those systems are compromised, the strength of the vault alone cannot prevent every kind of attack.

Crypto platforms face a similar challenge.

Hot, warm and cold wallets

The incident also highlights why exchanges separate their digital assets into different wallet environments.

Hot wallets are connected to systems that allow transactions to be processed more readily. They are useful for day-to-day operations but, because they interact with online systems, they can present greater exposure to cyberattacks.

Cold wallets, on the other hand, are kept offline or otherwise isolated from routine online activity. They are generally used to store assets with less frequent movement.

Bitget operates a three-tier wallet architecture involving hot, warm and cold wallets. The company says the September 24 incident was limited to portions of its hot and warm wallet infrastructure, while its cold wallets remained unaffected.

That separation helped limit the scope of the incident.

But it also demonstrates why security is never just about one password or one device. A crypto transaction can pass through several layers of software, authentication systems and infrastructure before it reaches the blockchain.

Every layer matters.

What happened after the breach

Bitget temporarily suspended withdrawals while its security and technical teams investigated the incident and checked the withdrawal infrastructure.

Trading and deposits continued, according to the exchange, while withdrawals were restored in phases after additional security checks. Bitcoin withdrawals resumed on September 28, followed by Ethereum on September 29, with other assets scheduled for subsequent restoration.

Bitget says its User Protection Fund, which held more than $464 million, covers the financial impact of the incident. It has also engaged Mandiant and SlowMist to support the investigation and launched a recovery bounty programme for affected assets.

The investigation and recovery efforts remain ongoing.

And because blockchain transactions are publicly traceable, investigators and security firms can follow the movement of stolen assets between addresses. That does not automatically mean funds can be recovered, but it gives investigators a record of where the assets move after a theft.

So, is keeping crypto on an exchange unsafe?

Not necessarily.

But the Bitget incident is a useful reminder that custody comes with a different set of risks.

When you leave assets on a centralised exchange, you are relying on the exchange's security architecture, internal controls, withdrawal systems and incident-response procedures.

With a self-custodial wallet, you have greater direct control over your assets, but you also take greater responsibility for your private keys, recovery phrase and transactions.

Neither approach eliminates risk.

The important thing is understanding where that risk sits.

For an exchange user, that means looking beyond trading fees and the number of coins supported. Security practices, custody arrangements, withdrawal controls, protection mechanisms and the platform's response to previous incidents are also worth considering.

For self-custody users, the responsibility moves closer to home: protect the recovery phrase, verify transaction details and be extremely careful about the applications and services connected to the wallet.

The bigger crypto lesson

The Bitget incident is a reminder that the cryptocurrency ecosystem is much larger than the blockchain itself.

There are exchanges, wallets, applications, smart contracts, bridges, security systems, authentication tools and third-party services sitting around the networks that process digital assets.

A vulnerability in one of those layers can become a serious problem.

That is why crypto security cannot end with “I protected my password.”

You also need to understand who is holding your assets, how transactions are authorised and what systems stand between your crypto and its destination.

The more you understand those layers, the better equipped you are to make informed decisions about where and how you use digital assets.

And when it is time to turn supported crypto into naira for everyday use, Monica keeps the journey straightforward. Convert your crypto, receive your naira and get back to the things that matter without making the process feel like another crypto lesson.

Your crypto journey should not stop at owning digital assets. When you are ready to bring them into everyday life, take the Monica route: https://monica.cash/app