Bitget lost about US$387.5 million from its exchange hot and warm wallets on 24 September 2026. As of 28 September, the exchange says no private keys were stolen. Instead, the attacker exploited a vulnerability in a third-party security product, gained privileged internal access, and sent fraudulent withdrawal commands that Bitget's own systems then authorised. Bitget says its User Protection Fund covers the loss, and withdrawals are coming back in phases from 28 September.
The incident is the largest crypto hack of 2026 so far. It is also a clear example of a risk that gets less attention than smart contract bugs: the tools a company buys to protect itself can become the way in.
What happened
Bitget detected unauthorised transfers from some of its hot wallets at 18:31 UTC on Thursday, 24 September, according to The Block. It suspended withdrawals, flagged the receiving addresses and kept deposits and trading open.
The first estimate was about $351.6 million. On 25 September Bitget raised it to $387.5 million after on-chain tracing added transfers on Zcash and Tron. The exchange said the higher figure was a reconciliation of the original incident, not a second theft.
| Item | Detail (as of 28 September 2026) |
|---|---|
| Loss | About $387.5 million (first estimate $351.6 million) |
| Wallets hit | Exchange hot and warm wallets. Bitget says cold wallets were not affected |
| Not affected | Bitget Wallet, the separate self-custodial app, which runs on separate infrastructure |
| Chains named | Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain, Base, plus Zcash and Tron in the revision |
| Coverage | User Protection Fund of more than $464 million (about 5,500 BTC) |
| Investigators | Mandiant and SlowMist; law enforcement notified |
| Recovery bounty | 5% of funds recovered or frozen |
How the attacker got in
Bitget CEO Gracy Chen said in a livestream that the attacker compromised a critical backend system in the exchange's wallet infrastructure. They spoofed transaction data and triggered the normal authorisation process to move funds. Fortune reported her account as attackers tricking the internal approval system rather than stealing keys.
On 28 September Bitget gave more detail, reported by ForkLog. The attacker exploited a vulnerability in a third-party security product to obtain privileged internal credentials. They used those credentials to send fraudulent withdrawal commands to the wallet system, bypassing existing risk controls. Bitget says the vulnerability has been addressed and no new unauthorised transfers have been detected.
As of today the vendor and product have not been publicly named. Bitget says a full security report is due this week. Until it is out, the precise attack path and how long the attacker had access are unknown.
The pattern matters more than the name. The keys were safe. The signing system did exactly what it was built to do. The weak point was the layer that decides what gets signed: the system that tells the signer "this withdrawal is legitimate". If an attacker controls that layer, they do not need the keys.
Who is suspected
Chen said the attacker was likely a North Korean group. Elliptic, the blockchain analytics firm, assessed on 25 September that the theft is "highly likely to be linked" to the DPRK. It cited infrastructure overlap with the 2025 Bybit exploit and links to an earlier DPRK-attributed theft. Elliptic also described a familiar laundering pattern: stablecoins and other tokens were converted into each chain's native asset within minutes, and funds on Arbitrum were bridged to Ethereum.
If the attribution holds, Elliptic says Bitget is the largest single DPRK-attributed theft of 2026. It also pushes the regime's tracked total for the year past $1 billion, across more than 51 incidents. Attribution here is an analytic assessment, not a legal finding.
Freezes and recovery so far
The quick swap into native assets limited what issuers could freeze. Decrypt reported that Circle blacklisted about 99,990 USDC and Tether about 218,023 USDT in one exploiter wallet, roughly $318,000 combined. ETH is not freezable, and other exploiter-linked addresses held more than 63,000 ETH at the time.
On withdrawals, Bitget published a phased plan:
- 28 September: Bitcoin withdrawals resumed. ForkLog reported 9,585 orders for about 4,098 BTC in the first hour.
- 29 September: ETH on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism.
- 30 September: USDT on Ethereum, BNB Smart Chain, Solana and Tron.
- 2 October: Other tokens, fiat and P2P.
Bitget says user balances are unaffected and the Protection Fund absorbs the loss.
Lessons for exchanges and projects running hot wallets
Few teams will ever hold $387 million in a hot wallet. But plenty of projects run hot wallets for market making, treasury operations, reward payouts, bridges or trading bots. Bitget's own remediation list, which covers vendor evaluation, access controls, withdrawal checks and suspicious-activity detection, is a good template.
1. Treat security vendors as part of your attack surface
A security appliance usually sits in a privileged position: network inspection, endpoint control, credential storage. That makes it a high-value target. Before buying, ask:
- What can this product reach, and with which credentials?
- Does it need a network path to the wallet environment at all?
- How fast does the vendor patch, and do you get advance notice of vulnerabilities?
- Can you monitor and alert on the appliance's own administrative actions?
Segment it so that compromising the appliance does not open a route to anything that can request a withdrawal.
2. Verify what is signed, not just who asked
Bitget's attacker spoofed transaction data and the approval flow accepted it. The control that addresses this is an independent check close to the signer. A separate service with its own data sources should decode and simulate each transaction before the key signs it. Then it should compare the result with policy: destination allowlists, amount limits, asset types, expected contract calls. If the request says "withdraw to user X" but the decoded transaction sends funds to an unknown address, the signer refuses.
3. Rate-limit hot wallets by design
A hot wallet should never be able to empty itself in one burst. Use per-transaction and per-hour value caps, velocity checks on new destinations, and an automatic pause when outflows exceed a threshold. Set these at the signing layer, not in the application that might be compromised. They will not stop a determined attacker, but they turn a nine-figure loss into a smaller one and buy time to react.
4. Segregate and minimise balances
Keep hot balances close to what operations actually need, and top them up from warm or cold storage on a schedule. Separate wallets by chain and by function, so one compromised path cannot reach everything. Bitget's cold wallets and its self-custodial product were untouched because they ran on separate infrastructure. That separation is worth copying.
5. Prepare the first hour
Bitget detected the transfers, paused withdrawals, flagged addresses, brought in outside investigators and published a coverage commitment within about a day. Have your own runbook ready:
- Who can pause withdrawals?
- Which issuers and exchanges do you contact to request freezes, and how?
- Who speaks publicly?
- What reserve covers users if funds are not recovered?
Speed matters. Decrypt's reporting shows most freezable stablecoins were converted before issuers acted.
For smart contract teams, the same "who can trigger a transfer, and on whose word" question applies to admin keys, upgrade rights and off-chain relayers. Our DeFi security overview covers the protocol side. If you want an outside review of your wallet architecture, signing flow or vendor exposure, that is the scope of our cybersecurity service.
What to watch next
The Mandiant and SlowMist findings, and Bitget's promised report, should clarify the product involved and how long the attacker was inside. Other companies running the same product should watch for the vendor's advisory. For users, the practical points are that the exchange has committed to cover the loss and that withdrawals are reopening by asset over the coming days.
Sources
- The Block — Bitget confirms $387.5 million security breach affecting exchange hot wallets
- Fortune — North Korea accused of plundering Bitget for $387 million in year's biggest crypto attack
- Elliptic — Bitget attack pushes suspected North Korea crypto heists over $1 billion in 2026
- Decrypt — Circle and Tether freeze stablecoins tied to Bitget hack, but most funds slip away
- ForkLog — Bitget reveals hack cause and resumes Bitcoin withdrawals
- BleepingComputer — Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
- DefiLlama — Hacks database
How we research, write and fact-check: Editorial & AI policy.
Disclaimer: this article is for informational and educational purposes only and does not constitute financial, investment, legal or tax advice. Crypto-assets are volatile and high-risk: always do your own research (DYOR) and consult a qualified professional before making any decision. Not financial advice.
