Bitget Hack: $387.5M Drained From Hot Wallets, North Korea Suspected

Short answer: On Thursday, September 24, 2026, at 18:31 UTC, Bitget's monitoring flagged unauthorized transfers out of its hot and warm wallets. The attackers did not steal private keys: they got into a backend system of the exchange's wallet infrastructure, forged withdrawal requests and let Bitget's own approval process send the funds. The loss, first put at $351.6 million, was revised by September 25, 2026 to about $387.5 million, the largest crypto hack of the year so far. Bitget and several analytics firms point to North Korean state hackers, and the exchange says its User Protection Fund of more than $464 million covers the full loss.

What happened at Bitget?

The alarm went off on the evening of September 24 (UTC), early on September 25 in Asian time zones. Within roughly an hour, on-chain investigators had counted close to $183 million in stablecoins, ether and other tokens leaving addresses tagged as Bitget's. The exchange confirmed the incident the same night, first estimating the damage at $351.6 million, and later raised the figure to about $387.5 million as more transfers across networks were reconciled.

CEO Gracy Chen said the attackers compromised a critical backend system inside the wallet infrastructure, used it to spoof transaction data and triggered the normal authorization flow. In other words, the fraudulent withdrawals looked legitimate to the checks that were supposed to stop them. Chen stated that a private key compromise had been ruled out and that cold wallets, which are kept offline, were not affected. Bitget's separate self-custodial product, Bitget Wallet, was also not involved.

As a precaution Bitget paused withdrawals pending a security review, while deposits and trading stayed open. It brought in Mandiant and SlowMist for forensics, published a tracking dashboard for researchers and announced two bounties: 5% of any amount frozen by third parties and 5% of any amount voluntarily returned. According to The Hacker News, Circle and Tether froze only a small amount of stablecoins, around $339,100, because much of the loot had already been converted.

Who is behind the Bitget hack?

Chen said the IP addresses seen in the attack matched VPN services favored by a specific North Korean group. Blockchain analytics firm Elliptic called a North Korean link highly likely, and independent investigators, including ZachXBT, tied the activity to the Lazarus Group. Some analysts describe the pattern as typical of TraderTraitor, a Lazarus-linked unit. The fast conversion of stablecoins into ether, which cannot be frozen by an issuer, fits the same playbook. Formal attribution was still pending as of September 25.

Key facts

Item	Detail
Detected	September 24, 2026, 18:31 UTC
Amount stolen	About $387.5 million (initial estimate $351.6 million)
Wallets hit	Hot and warm wallets; cold wallets not affected
Assets and networks	ETH, XRP, BNB, AVAX, USDT, USDC and others on Ethereum, XRP Ledger, BSC, Arbitrum, Optimism, Avalanche and Base
Method	Compromised backend system, forged withdrawal requests approved by the normal process; no private keys stolen
Suspected attacker	North Korean state hackers (Lazarus / TraderTraitor), not yet formally confirmed
Compensation	User Protection Fund of over $464 million, which Bitget says covers the full loss
Bounties	5% for freezing funds, 5% for voluntary return
Withdrawals	Paused on September 24; phased reopening from September 28

What came out after September 25

September 28, 2026. Bitget disclosed the root cause: a vulnerability in a third-party security product used by the exchange gave the attacker high-level internal credentials, which were then used to issue fraudulent withdrawal commands. The vendor was not named. Bitget said it had restricted internal access, added independent withdrawal verification and tightened monitoring. Bitcoin withdrawals resumed that Monday, with ether and USDT following over the next days and other tokens, fiat and P2P services scheduled for October 2.

September 29, 2026. Customers moved about $463 million in net outflows off the exchange in the 24 hours into Tuesday, the largest one-day outflow since DefiLlama began tracking proof-of-reserves four years ago. Bitget said its protection fund had fallen below $200 million after covering the hole and that it would rebuild it above $300 million within a week from its own capital.

September 30, 2026. SlowMist's findings, reported by Cointelegraph, traced the earliest malicious activity back to August 31, when a zero-day in the third-party product was exploited. Investigators also recovered a deleted custom tool that forged risk-control parameters and built withdrawal requests. Chen said she was not optimistic about recovering most of the funds.

Why does it matter?

The Bitget case shows that "the keys were safe" is not the same as "the funds were safe." Exchanges defend hot wallets with approval systems, risk engines and multisig policies, but if an attacker can make a malicious withdrawal look legitimate from the inside, those controls sign it anyway. The entry point here was a security product, the very kind of tool meant to reduce risk. The same pattern, where trusted internal machinery is turned against its owner, keeps recurring in large incidents, including cross-chain exploits like the recent Symbiosis Bitcoin bridge exploit.

Customers were spared because Bitget had a large reserve fund. That is good news, but it is a company decision, not a guarantee. A smaller platform without such a fund, or a bigger theft, would leave users waiting in line as creditors. The record outflows after withdrawals reopened show that many users drew the same conclusion.

What to do: a practical checklist

Keep only trading balances on exchanges. Whatever you are not actively trading belongs in a wallet you control. Our self-custody wallet security guide covers hardware wallets and seed backups.
Withdraw calmly, not in panic. During a phased reopening, check the official announcement for which coins and networks are live, send a small test first and double-check the address.
Beware of "refund" and "compensation" phishing. After every big hack, fake support accounts, emails and sites offer to "restore" balances or ask you to "verify" your wallet. Bitget covers losses at the account level, so no user needs to connect a wallet, share a seed phrase or pay a fee to be made whole. See how to avoid crypto exchange scams.
Use only official channels. Type the exchange address yourself and follow announcements in the app, not links from direct messages or search ads.
Prefer non-custodial swaps for one-off exchanges. Instant exchangers and aggregators that send coins straight to your own address do not hold your balance between trades. You can compare them on the exchangers list.

FAQ

How much was stolen in the Bitget hack?

About $387.5 million, according to Bitget's revised figure. The first estimate on September 24, 2026 was $351.6 million. It is the largest crypto hack of 2026 so far.

How did hackers break into Bitget?

They compromised a backend system in Bitget's wallet infrastructure, forged withdrawal requests and let the normal approval process send the funds. On September 28 Bitget said the entry point was a flaw in a third-party security product that gave the attacker high-level internal credentials. No private keys were stolen.

Was North Korea behind the Bitget hack?

It is suspected but not formally confirmed. Bitget cited IP addresses matching VPNs used by a North Korean group, Elliptic called a link highly likely, and independent researchers attributed the attack to the Lazarus Group.

Did Bitget users lose their money?

Bitget says no: account balances were not changed and the loss is covered by its User Protection Fund, which held more than $464 million. Cold wallets were not affected.

Can I withdraw from Bitget now?

Withdrawals were paused on September 24 and reopened in stages from September 28, starting with bitcoin, then ether and USDT, with other tokens, fiat and P2P scheduled for October 2. Check the official Bitget announcements for the current status.