Bitget Exchange Hack: How $387.5M Was Stolen & Who Is Suspected?
Bitget Exchange Hack: $387.5 Million Crypto Breach Explained — How It Happened, Who Is Suspected, and What Happens Next
Bitget says approximately $387.5 million in crypto assets were transferred to attacker-controlled addresses following the September 24, 2026 security incident.
The cryptocurrency industry is facing another major security incident after Bitget exchange was hacked on September 24, 2026, resulting in the unauthorized transfer of digital assets worth approximately $387.5 million to attacker-controlled addresses.
The incident initially appeared to involve about $351.6 million, but Bitget later revised the figure upward after on-chain investigators identified additional affected assets on Zcash and TRON. Importantly, Bitget says the revised figure represents a more complete accounting of the same incident rather than a second wave of theft.
The Bitget hack has attracted particular attention because the attackers apparently did not simply steal private keys from Bitget's cold storage. Instead, investigators say the attackers compromised a backend component of the exchange's wallet infrastructure and manipulated transaction information to get unauthorized transfers approved.
There is also growing suspicion that the attack may be connected to North Korean-linked cybercrime groups, although that attribution remains an investigative assessment rather than a formally established fact.
Here is what we know so far about the Bitget exchange hack, how it happened, the assets involved, who is suspected, and what Bitget is doing to respond.
Bitget Hack at a Glance
| Detail | What is currently known |
|---|---|
| Date of incident | September 24, 2026 |
| Initial estimated loss | Approximately $351.6 million |
| Revised amount transferred | Approximately $387.5 million |
| Affected infrastructure | Portions of Bitget's hot and warm wallet systems |
| Cold wallets | Reported unaffected |
| Private keys | Bitget says they were not compromised |
| Attack method | Backend wallet-system compromise and transaction-data manipulation |
| Affected assets | XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, TRX and others |
| Investigation partners | Mandiant and SlowMist |
| Suspected perpetrator | Possible DPRK/North Korean-linked hacking group |
| User Protection Fund | More than $464 million at the time of Bitget's initial announcement |
| Withdrawal restart | Scheduled in phases beginning September 28 |
Sources: Bitget, The Block and security-research reporting.
What Happened in the Bitget Exchange Hack?
The incident began on September 24, 2026, when Bitget's security systems detected unauthorized transfers from some of its hot wallets at approximately 18:31 UTC.
Hot wallets are cryptocurrency wallets connected to systems that facilitate active transactions and withdrawals. They are fundamentally different from cold wallets, which are kept offline or otherwise isolated from the internet for enhanced security.
Bitget immediately activated its emergency response procedures, identified suspicious addresses and temporarily suspended withdrawals while its security team investigated the incident.
At first, the exchange estimated that approximately $351.6 million worth of assets had been affected.
Further blockchain analysis subsequently identified additional transfers involving Zcash and TRON. This led Bitget to revise its estimate to approximately $387.5 million.
The exchange emphasized that the increase did not represent additional unauthorized transfers. Instead, investigators had obtained a more complete picture of the transactions associated with the original incident.
How Was Bitget Hacked?
One of the most important aspects of this Bitget hack is that available evidence does not point to a straightforward theft of Bitget's private keys.
According to Bitget CEO Gracy Chen and subsequent reporting, attackers compromised a backend system associated with Bitget's wallet infrastructure.
The attackers apparently manipulated or spoofed transaction information within that system and then used the legitimate authorization mechanism to initiate transfers.
In simplified terms, the attack can be understood as follows:
Backend compromise → transaction information manipulated → authorization process triggered → assets transferred to attacker-controlled addresses
This distinction matters.
A conventional crypto-wallet theft might involve an attacker obtaining a private key or seed phrase and then directly signing blockchain transactions.
The Bitget incident appears different.
According to Chen's account, the attackers did not obtain the private keys associated with Bitget's cold wallets, and the exchange has said its separate cold-wallet infrastructure remained secure. The separate self-custodial Bitget Wallet product was also reported as unaffected.
Bitget subsequently stated that it had identified the underlying vulnerability and remediated it. Mandiant and SlowMist are assisting with the continuing investigation and security validation.
Why the Attack Method Matters
The incident demonstrates that cryptocurrency security is not exclusively about protecting private keys.
Even when blockchain wallets themselves are properly secured, an exchange can have many layers of infrastructure between a user request and an eventual blockchain transaction.
These layers can include:
- Wallet-management systems
- Backend APIs
- Transaction databases
- Signing services
- Authorization systems
- Risk-management systems
- Monitoring infrastructure
- Internal administrative tools
If an attacker compromises a sufficiently privileged backend component, they may be able to manipulate the information that legitimate security systems rely upon.
That is why the Bitget incident is significant from a cybersecurity perspective.
Which Cryptocurrencies Were Affected?
The Bitget exchange hack involved multiple digital assets and blockchain networks.
According to Bitget's latest incident update, confirmed affected assets include:
- XRP
- Ethereum (ETH)
- Tether (USDT)
- Zcash (ZEC)
- USD Coin (USDC)
- USDT0
- Tether Gold (XAUt)
- BNB
- Avalanche (AVAX)
- TRON (TRX)
The incident involved Ethereum and several EVM-compatible networks as well as the XRP Ledger, Zcash and TRON.
Blockchain transactions are publicly observable, allowing researchers and security companies to trace movements after funds leave an exchange.
Bitget has identified several attacker-controlled addresses and has made fund-tracing information available to security researchers and other industry participants.
That transparency is particularly important because stolen cryptocurrency can sometimes be frozen before it reaches a service where it can be converted or further moved.
Were Bitget User Funds Stolen?
This is one of the most important questions surrounding the Bitget hack.
Bitget says that customer account balances were not affected and that the financial impact of the incident is covered by its User Protection Fund.
At the time of the initial announcement, Bitget said its protection fund contained more than $464 million, exceeding the initial estimated $351.6 million loss.
However, it is important to distinguish between two things:
Unauthorized transfers from Bitget's exchange wallet infrastructure and a reduction in individual customers' displayed account balances are not necessarily the same event.
Bitget's position is that its users' balances remain intact while the exchange absorbs the loss through its protection mechanisms.
The company has also stated that the incident remains contained and that no further unauthorized transfers are possible following remediation of the vulnerability.
Who Is Suspected of the Bitget Hack?
The question of attribution has become one of the biggest stories surrounding the Bitget exchange hack.
Bitget CEO Gracy Chen has publicly suggested that the attack may be connected to a North Korean-linked hacking group, based on preliminary technical indicators.
Chen said investigators identified IP addresses whose VPN characteristics appeared similar to infrastructure previously associated with a North Korean hacking group. She also described the attack pattern as resembling previous operations attributed to DPRK-linked hackers.
Blockchain intelligence firm Elliptic has also assessed the attack as highly likely to be linked to the DPRK, citing several indicators including infrastructure overlap and connections between funds from the Bitget incident and addresses associated with earlier DPRK-attributed attacks.
However, readers should be careful with the wording here.
North Korea has not been established as the perpetrator through a final public law-enforcement finding based on the information currently available.
The appropriate description at this stage is that North Korean/DPRK-linked cybercriminals are suspected, based on preliminary technical and blockchain intelligence.
Mandiant, SlowMist, Bitget and law-enforcement authorities remain involved in the investigation.
Why North Korean Hackers Are Being Considered
North Korea-linked hacking groups have been repeatedly associated by governments and blockchain intelligence companies with large-scale cryptocurrency theft.
The broader pattern involves sophisticated cyber operations targeting:
- Cryptocurrency exchanges
- Blockchain projects
- DeFi protocols
- Wallet infrastructure
- Cryptocurrency companies
- Developers
- Employees and contractors
- Digital asset service providers
The suspected DPRK connection in the Bitget incident is therefore being examined in the context of a much broader history of crypto-related cybercrime.
Elliptic said the Bitget attack pushed its tracked total of DPRK-attributed cryptocurrency theft during 2026 above $1 billion.
Again, this figure represents Elliptic's attribution and tracking methodology rather than a court determination.
Bitget's Response to the Hack
Bitget moved quickly after detecting the unauthorized transfers.
The exchange:
- Activated its emergency security response.
- Identified suspicious transaction addresses.
- Suspended withdrawals.
- Notified law enforcement.
- Engaged external cybersecurity specialists.
- Began on-chain fund tracing.
- Identified and fixed the underlying vulnerability.
- Began additional security validation.
- Established a recovery bounty program.
- Prepared a phased withdrawal restart.
Bitget says Mandiant and SlowMist are assisting with the investigation and security checks.
The exchange has also reported that some affected assets have already been frozen through coordination with industry partners.
Bitget Launches Recovery Bounty Program
Another notable development following the Bitget hack is the exchange's recovery bounty program.
According to Bitget, eligible participants can receive a bounty for actions that directly result in affected funds being frozen or recovered.
The published program offers:
- 5% of successfully frozen funds to an eligible contributor whose voluntary efforts directly caused the freeze.
- 5% of successfully recovered funds to an eligible contributor whose voluntary efforts directly contributed to recovery.
Bitget says the final determination of eligibility and bounty amounts remains with the exchange.
The program illustrates one of the advantages—and challenges—of blockchain-based investigations.
Because blockchain transactions are publicly recorded, researchers can monitor addresses and track how stolen assets move between wallets.
But tracing cryptocurrency is not the same as recovering it.
Funds may move through multiple wallets, decentralized exchanges, bridges, mixers or other services, making recovery considerably more difficult.
Bitget Withdrawals: When Will They Resume?
The temporary withdrawal suspension has been one of the biggest concerns for Bitget users.
Bitget has now published a phased withdrawal restoration schedule.
According to the exchange:
September 28, 2026 — BTC
Bitcoin withdrawals are scheduled to resume at 08:00 UTC.
September 29, 2026 — ETH
Ethereum withdrawals are scheduled to return at 08:00 UTC across:
- Ethereum
- BNB Smart Chain
- Arbitrum
- Base
- Optimism
September 30, 2026 — USDT
USDT withdrawals are scheduled to return at 08:00 UTC across:
- Ethereum
- BNB Smart Chain
- Solana
- TRON
October 2, 2026 — Remaining Services
Other tokens, fiat services and peer-to-peer services are scheduled for the final phase.
Bitget says the phased approach is intended to allow additional security validation before each service is restored. Trading and deposits have continued, according to the exchange.
What the Bitget Hack Means for Crypto Security
The Bitget incident provides several important lessons for the cryptocurrency industry.
1. Private-Key Security Is Not Enough
Exchanges need to protect not only private keys but also every system that can influence transaction authorization.
Backend systems, APIs, signing infrastructure and administrative controls can all become attack surfaces.
2. Hot Wallets Remain High-Value Targets
Hot wallets are convenient because they enable fast transactions.
But because they are connected to operational infrastructure, they also present attractive targets for attackers.
This is one reason major exchanges typically separate hot, warm and cold storage.
3. Transaction Authorization Needs Multiple Layers
A compromised backend should ideally not be able to independently authorize large transfers.
The incident highlights the importance of:
- Multi-party authorization
- Transaction simulation
- Independent policy engines
- Address allowlisting
- Withdrawal limits
- Anomaly detection
- Hardware-backed signing
- Real-time monitoring
- Emergency circuit breakers
4. On-Chain Transparency Can Help Investigations
One advantage of public blockchains is that investigators can follow transactions after assets leave an exchange.
Security companies and exchanges can identify suspicious addresses and notify other industry participants.
That does not guarantee recovery, but it can make laundering stolen cryptocurrency more difficult.
Is Bitget Still Operating?
Based on Bitget's latest published updates, the exchange remains operational for trading and deposits, while withdrawals are being restored through a phased process.
Bitget says the incident has been contained and the vulnerability has been remediated. Its published schedule begins withdrawal restoration with BTC on September 28 and progresses through October 2 for remaining services.
Users should nevertheless rely on Bitget's official platform notices when attempting withdrawals because operational schedules can change during a security incident.
What Should Bitget Users Do Now?
For users following the situation, several practical precautions make sense.
Monitor official announcements
Avoid relying solely on posts circulating on social media.
Be careful of phishing scams
Major exchange hacks often create opportunities for scammers.
Attackers may create fake websites or messages claiming to offer:
- Compensation
- Refunds
- Emergency withdrawals
- Recovery services
- Account verification
- Security updates
Never provide your seed phrase or private keys in response to an unsolicited message.
Verify withdrawal networks
When withdrawals reopen, users should carefully verify the selected blockchain network and destination address before confirming transactions.
Enable account security controls
Users should review available security settings, including:
- Two-factor authentication
- Anti-phishing codes
- Withdrawal address controls
- Device management
- Login alerts
The Bigger Picture: Why the Bitget Hack Matters
The Bitget exchange hack is more than another headline about cryptocurrency theft.
The incident demonstrates how modern crypto attacks can target the infrastructure surrounding blockchain transactions rather than simply attacking the blockchain itself.
The attacker reportedly did not need to compromise Bitget's cold wallets.
Instead, the attack focused on a backend component capable of influencing the transaction authorization process.
That distinction could become particularly important for the future design of centralized cryptocurrency exchanges.
As exchanges hold increasingly large amounts of customer assets, security architecture must account for sophisticated attacks against software, employees, authentication systems, APIs and internal infrastructure—not just cryptographic keys.
The reported $387.5 million scale of the incident also places it among the largest crypto security breaches of 2026 so far, according to contemporary reporting.
Final Takeaway: What We Know About the Bitget Hack
The Bitget exchange hack on September 24, 2026 resulted in approximately $387.5 million in cryptocurrency being transferred to attacker-controlled addresses, according to Bitget's latest accounting.
The initial estimate of $351.6 million increased after investigators included additional Zcash and TRON transfers.
The available evidence indicates that the attackers compromised a backend component of Bitget's wallet infrastructure and manipulated transaction information, rather than simply stealing the exchange's cold-wallet private keys. Bitget says its cold wallets remained secure and that its separate Bitget Wallet product was unaffected.
The investigation has also produced preliminary indications pointing toward North Korean/DPRK-linked hackers, although that remains a suspected attribution rather than a conclusively established perpetrator.
Bitget has said the vulnerability has been fixed, its protection fund covers the financial impact, and it has begun working with Mandiant, SlowMist, law enforcement and other blockchain companies to trace and recover assets.
The next major milestone is the phased reopening of withdrawals beginning September 28, 2026, starting with BTC and continuing through ETH, USDT and other assets and services.
For the wider crypto industry, the incident is a reminder that exchange security depends on much more than protecting private keys. Backend infrastructure, authorization systems, transaction integrity and operational controls can all become critical attack surfaces.
As the investigation continues, additional details about the exact attack path, attribution and recovery of the stolen funds may emerge. For now, the Bitget incident remains a major Crypto News story and an important case study in the evolving cybersecurity risks facing centralized cryptocurrency exchanges.
This article is for informational purposes only and is not financial advice. Details surrounding the Bitget security incident remain subject to investigation and may change as new evidence becomes available.
0 Comments: