Crypto crisis communication is tested hardest in the hours after a hack, when users can watch funds leave your wallets onchain before you have said a word. On 24 September 2026 Bitget announced on X that its security systems had detected unauthorized transfers from a limited number of hot wallets, the wallets an exchange keeps online for everyday withdrawals. Within days the loss was put at about $387.5 million. According to CertiK data reported by Cointelegraph, that made it the largest single incident of the third quarter.

At AnkhLabs we think Bitget's response is worth studying because it is a recent, well-documented example of an exchange communicating through a crisis in public. (AnkhLabs has worked with Bitget.) Our earlier piece on the Bybit hack and exchange security covered how attacks happen. This one is about what you say after one does.

What happened in the Bitget hack?

Bitget's systems flagged unauthorized transfers from a small number of wallets, and the exchange suspended withdrawals. In its first statement it said "approximately $351.6 million in assets were affected" and that the incident "falls within the coverage of Bitget's User Protection Fund, which currently holds more than $464 million", BleepingComputer reported. The fund is a reserve Bitget keeps to cover user losses, and it held about 5,500 BTC. Assets were taken on several chains, including Ethereum, the XRP Ledger, BNB Smart Chain and Base.

The next day Bitget raised its estimate to about $387.5 million. The increase came from affected assets on Zcash and TRON that the first count had missed, and the company said it did not reflect any new transfers. Chief executive Gracy Chen said on a livestream that a North Korean hacking group may be responsible, while Bitget itself stopped short of confirming attribution, according to PYMNTS.

By 28 September Bitget had explained the cause. Attackers used a vulnerability in a third-party security product to obtain privileged internal credentials, then sent forged withdrawal commands that bypassed its risk controls. Private keys and cold wallets were not compromised, ForkLog reported. Mandiant and SlowMist were named as forensic partners, some stolen funds had been frozen, and Bitget said it would publish an official security report.

How Bitget communicated, day by day

Sources: PYMNTS, BleepingComputer, ForkLog. Dates are 2026.

The phased schedule was published down to the hour, with each step at 08:00 UTC, as BleepingComputer detailed. Bitget also repeated that "the temporary withdrawal pause remains a security measure and is not related to the availability of user assets", a sentence aimed squarely at the fear that drives bank runs.

What is crypto crisis communication, and why is a hack different?

Crisis communication is the plan for what an organisation says, through whom and when, while something is going badly wrong. In most industries a company controls the first account of its own crisis. In crypto it rarely does. Blockchains are public, so security researchers, analytics firms and anonymous accounts on X often spot large outflows before the company has finished its first internal call.

That changes the job. You are not breaking the news. You are confirming it, sizing it and telling people what it means for their money. Every hour of silence is filled by guesses, and in a market where users can withdraw in minutes, guesses turn into a run. The test of a good response is simple: does a worried user, reading only your official channels, know whether their funds are safe and when they can move them?

The first hour: confirm, size and reassure with facts

The first statement does not need every answer. It needs five things: confirmation that an incident is happening, the best current estimate of its size, what is unaffected, what is paused, and when the next update will come. Bitget's first post covered almost all of them, including the line that "customer account balances remain accurate, and deposits and trading continue to operate normally".

Bybit set the template a year and a half earlier. When it lost about $1.4 billion from an Ethereum cold wallet on 21 February 2025, chief executive Ben Zhou confirmed the hack on X and went live the same day. He wrote that "Bybit is Solvent even if this hack loss is not recovered", Fortune reported, and described "massive withdrawals" as users moved funds out.

A few rules hold for this hour:

• Post first on the channel users check first. For most exchanges and protocols that is X, then Telegram and Discord. Pin the post and point every other channel to it.

• Give a number, labelled as an estimate. A range or a first figure with "based on our current assessment" beats "an incident is under review".

• Say what is safe in specifics. "Cold wallets are unaffected" and "the self-custodial wallet runs on separate infrastructure" are more convincing than "funds are SAFU", crypto slang for funds being safe.

• Name the next update time and keep to it, even if the update is that there is nothing new.

The first day: correct openly and put a person on camera

Numbers will change. What matters is how. Bitget's revision added about $36 million to the loss, but it came with the reason and a clear statement that no further transfers had occurred. A revised figure without that context reads as a crisis getting worse.

The first day is also when the founder or chief executive should appear in person. Both Chen and Zhou went live on video. A live session is risky because you cannot script every answer, but it is the fastest way to show that someone senior is in charge. We covered why this works in our article on founder-led marketing. In a crisis the same trust is either spent or earned in a single afternoon.

Be careful with attribution. Chen said a North Korean group may be responsible, but the company did not confirm it. That is the right split. Naming a suspect can help explain the scale of an attack, yet a wrong attribution becomes its own story.

The first week: dates, recovery and proof

By the end of the first week, users want three things: their money back, an explanation and evidence that it will not happen again.

• Dates for withdrawals. Bitget's per-asset schedule turned a vague pause into a calendar. Each reopening became a small good-news update.

• A recovery effort people can see. Bitget offered a 5% bounty. Bybit launched its own on 22 February 2025, pledging up to 10% of recovered funds, about $140 million if everything were reclaimed, CryptoSlate reported.

• Proof that the hole is filled. On 24 February 2025 Zhou posted that "Bybit has already fully closed the ETH gap" and promised a new audited proof-of-reserves report. A reserve attestation from a third party says more than any statement from the exchange.

• A root cause in plain words. Bitget's explanation, a flaw in a third-party product used to forge withdrawal commands, was specific enough to be credible without handing attackers a manual.

What should you never do after a crypto hack?

The clearest warning comes from WazirX, the Indian exchange that lost about $230 million in a 2024 hack. Its plan was to let users trade only 55% of their assets and convert the other 45% into locked tokens, applied to everyone whether or not their funds were affected. A user poll on the plan ran from 27 July to 3 August and drew strong opposition, Cointelegraph reported. Co-founder Nischal Shetty had to explain that the poll was not binding. Asking customers to share a loss is a legal and financial decision, but announcing it as a community vote turned it into a communication failure as well.

Other mistakes are quieter. Teams go dark for a day while lawyers review every word. They say "SAFU" or "all good" before they know it is true. They argue with critics in replies, or release one figure and then a different one with no explanation in between.

A crisis can also be reframed well. In May 2025 criminals who had bribed overseas support staff demanded $20 million from Coinbase. The company refused, disclosed the breach in a regulatory filing, and offered a $20 million reward for information leading to the attackers' arrest. "We said no," chief executive Brian Armstrong wrote, according to SecurityWeek. Coinbase also promised to reimburse customers tricked into sending funds to scammers. The breach was serious, but the story became one about the company standing up to extortion.

What we'd tell a founder

Most of crisis communication happens before the crisis. If you run an exchange, a wallet or a protocol holding user funds, prepare four things now.

First, write holding statements in advance. Draft the first post for a hot wallet breach, a smart contract exploit and a data leak, with blanks for the numbers. Agree who signs off, and make it two people, not a committee.

Second, brief your moderators. In a hack your Telegram and Discord admins become your front line, and you should expect impostors posing as support. Give moderators a pinned message, a list of official links and the authority to mute anyone posting fake recovery offers. Our guides to crypto community management and Telegram marketing cover how to set those channels up so they hold under pressure, and our community building and management work includes this kind of preparation.

Third, decide your safety net before you need it. Bitget could point to a fund worth more than its loss on the first day. If you have an insurance fund, a treasury reserve or a recovery plan, publish its size in calm times so users already know about it.

Fourth, plan the recovery story, not only the incident. Each withdrawal reopening, each frozen transfer and each audit is an update that rebuilds trust. More examples of our community and launch work are in our case studies.

If you want a second opinion on your incident communication plan before you ever need it, talk to AnkhLabs.

The bottom line

Bitget's theft was the largest of the quarter, yet its response is likely to be remembered for its pace and clarity. It gave a number on day one, a corrected number with a reason on day two and a dated plan for every asset by day four. Bybit and Coinbase showed the same instinct. Users forgive a hack faster than they forgive being kept in the dark.

This article is for information only and is not legal or investment advice. Figures are as reported by the sources linked and may be revised.