You can follow every security rule, keep your keys private, and still find your funds stuck because a platform you used got hit. That is the uncomfortable lesson of the latest exchange hack.
Bitget confirmed it lost about $351.6 million after attackers compromised a wallet backend and spoofed transaction data, and the company said its private keys were not compromised. Other outlets have reported higher figures, with Fortune putting the drained amount above $387 million, so the exact total depends on the source. CoinDeskFortune
If you spend crypto through a card, this matters to you even if you never touched Bitget. In this guide, we explain what happened, why it affects card users, and the seven steps that keep your crypto card balance safe.
What Happened in the Bitget Hack?
Unauthorized transfers began at around 18:31 UTC on September 24, 2026, from part of Bitget’s hot and warm wallet infrastructure. bitget
Here is what is known so far:
- It wasn’t a classic key theft. Bitget’s CEO said the attackers tricked the exchange’s internal approval system into authorizing the transfers instead of stealing private keys. Fortune
- Cold storage was not hit. Bitget said its offline cold wallets remained secure. CoinDesk
- Users were promised cover. Bitget said its User Protection Fund of more than $464 million would cover the loss, while withdrawals were suspended pending a security review. CoinDesk
- Self-custody was unaffected. Bitget Wallet, a separate self-custodial product where users control their own crypto, was not affected. Fortune
- Recovery has begun. Bitget confirmed a phased schedule for resuming withdrawals on September 26. NEAR Intents also blocked $50 million of swaps linked to the hack, while THORChain declined to freeze funds. bitgetblockchainreporter
Note: this situation is still developing. Check Bitget’s official channels for the latest status.
Why This Matters Even If You Don’t Use Bitget
The Bitget incident shows two risks that every crypto card user should understand.
- Strong keys don’t guarantee safe funds. The attack targeted the systems around the wallets, not the keys themselves. Security is only as strong as the weakest part of the chain.
- Safe and accessible are different things. Even when funds are protected, a platform can pause withdrawals. If your spending money sits there, you can’t use it when you need it.
Card balances have faced similar risks recently. In late August, a flaw in a legacy Rain card smart contract led to about $1.1 million in losses across Avici and Tria users on Solana. Assets kept in users’ own wallets stayed protected, but funds moved onto card balances entered a third-party contract where the vulnerability sat. We covered this in detail in our guide to Cardaxo’s Secure Custody Framework. blockonomiblockonomi
The takeaway: the money you keep in the places you spend from is where your exposure is. That is why the habits below matter.
Where Does Your Crypto Actually Sit?
Where it’s stored | Who controls it | Main risk | Best used for |
Exchange account | The exchange | Hacks, paused withdrawals | Active trading |
Your own wallet (self-custody) | You | Lost keys, phishing | Long-term holdings |
| Prepaid crypto card balance | You, via the card platform | Platform risk, fraud on card details | Day-to-day spending |
No option is risk-free. The goal is to match each type of storage to its job.
7 Ways to Protect Your Crypto Card Balance
1. Load only what you plan to spend
A prepaid crypto card like Cardaxo works best as a spending account, not a savings vault. Load enough for the next few weeks of expenses and top up as needed. A smaller balance means a smaller possible loss.
2. Keep long-term holdings in your own wallet
Your Bitcoin, Ethereum and other long-term holdings belong in self-custody where you control access, not on the card and not sitting on an exchange. Use the card only for spending.
3. Top up from your own wallet, not from a parked exchange balance
If withdrawals freeze, money left on an exchange can’t reach your card. Moving funds to your own wallet first gives you a spending route that doesn’t depend on any single platform. If you buy crypto through peer-to-peer trades, read our guide on how to avoid P2P scams while funding your virtual card.
4. Prefer stablecoins for card top-ups
A card balance in USDT or USDC doesn’t swing with the market, so what you loaded is what you can spend. It also makes budgeting simpler. Read more in our comparison: Why USDT and USDC are better than Bitcoin for everyday purchases.
5. Protect your account and card details
- Use a strong, unique password for your Cardaxo account and every exchange
- Enable two-factor authentication, preferably with an authenticator app instead of SMS
- Lock your phone with a PIN or biometrics
- Use Cardaxo virtual card for online shopping. It gives you a separate card number, expiry date and CVV, so your details stay apart from your main balance. Our guide to virtual vs physical cards explains when each one makes sense.
6. Review your transaction history regularly
Open your app once a week and scan your recent activity. Small, unfamiliar charges are often the first sign of a problem, and catching them early makes them easier to resolve.
7. Use official links only, especially after a hack
Every major breach is followed by scams: fake “compensation” forms, “verify your wallet” messages, and bogus recovery services. Never click links from unknown DMs or emails, and never share your seed phrase or verification codes with anyone.
This also applies to referral and bonus offers. If you invite friends through the Cardaxo Referral Program, share only your own official referral link from the app, and ignore “bonus” links from strangers. To learn how these traps work, read our guide to spotting and avoiding crypto scams.
What to Do If Your Exchange Gets Hacked
- Stay calm and don’t rush transfers. Panic moves to unknown addresses cause more losses.
- Follow official channels only. Check the exchange’s verified website and social accounts, not forwarded messages.
- Secure your accounts. Change your passwords and reset 2FA on the affected platform and any linked email.
- Watch for phishing. Expect fake support messages within hours.
- Move funds when withdrawals reopen. Once you can withdraw, consider shifting spending money to a wallet you control.
- Keep records. Save screenshots and transaction IDs in case you need them later.
How Cardaxo Fits Into a Safer Spending Setup
Cardaxo is built for spending, so it fits the “spend-only balance” approach. Its virtual card provides a unique card number, expiry date and CVV, works with Apple Pay and Google Pay, and runs on advanced encryption and security protocols with Web3 wallet technology. Users manage their cards and monitor transactions through the app.
If you’re still comparing options, our checklist for choosing a crypto card covers what to look for before you apply. Once your card is set up, you can also earn Candy Rewards with no lockup on your spending.
Your Quick Safety Checklist
- ✅ Card balance limited to what I plan to spend
- ✅ Long-term crypto stored in my own wallet
- ✅ Top-ups made from a wallet I control
- ✅ Stablecoins used for everyday spending
- ✅ 2FA enabled with an authenticator app
- ✅ Weekly review of my transactions
- ✅ Only official links and channels used
Frequently Asked Questions
Is my crypto card balance safe if an exchange gets hacked?
A hack on an exchange doesn’t automatically affect a separate card platform. But if you fund your card from an exchange that freezes withdrawals, you may not be able to top up. Funding from your own wallet avoids that.
How much crypto should I keep on my card?
A good rule is only what you expect to spend in the next few weeks. Treat the card like a wallet in your pocket, not a bank vault.
Are stablecoins safer for card top-ups?
They protect against price swings, not against platform or security risks. They make your balance predictable, which is helpful for everyday spending.
What should I do if withdrawals are paused on my exchange?
Don’t panic-transfer, rely on official announcements, secure your account, and watch for scam messages. When withdrawals reopen, move spending money to a wallet you control.
Is a virtual crypto card safer than a physical card for online shopping?
A virtual card has its own number, expiry date and CVV, which keeps your main card details apart from online purchases. Many people use one for online payments for that reason.
Final Thoughts
You can’t control whether an exchange gets attacked, but you can control how much of your money is exposed when it does. Load what you’ll spend, keep the rest in your own wallet, use stablecoins for stability, and stick to official links.
Ready to set up a spend-only balance? Download the Cardaxo app and get your virtual crypto card in a few steps.
Disclaimer: Cryptocurrency assets are highly volatile and unregulated, and holding or spending them carries a risk of loss. This article is for information only and is not financial or legal advice. Details about the Bitget incident are based on public reports at the time of writing and may change.
Sources: Bitget security incident timeline · CoinDesk · Fortune
