CryptoDailyCheck
Back to News
Bitget Hacked for $351.6M: What Happened, Who's Suspected, and Are User Funds Safe?

Bitget Hacked for $351.6M: What Happened, Who's Suspected, and Are User Funds Safe?

Updated: Sep 25, 2026, 09:41:54 PM GMT+2
•
6 min read
•
Mauro Saavedra
By Mauro Saavedra
Share this article:

Bitget, one of the world's ten largest crypto exchanges by trading volume, has confirmed it lost $351.6 million in a security breach on Thursday evening, making it the largest crypto hack of 2026 so far.

The exchange's systems flagged unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24. Within hours, CEO Gracy Chen confirmed the breach on X, insisting that "user funds are safe" and that the full loss is covered by Bitget's User Protection Fund. Withdrawals, however, remain frozen with no timeline for when they'll resume.

By Friday, the story had taken a darker turn: Bitget says preliminary evidence points to North Korean hackers.

What Happened: 19 Transfers, Multiple Chains, Under an Hour

The first alarm didn't come from Bitget. Pseudonymous on-chain researcher DCF GOD flagged unusual outflows on X late Thursday, and analysts at Bubblemaps and Arkham quickly followed. Early estimates put the damage at around $183 million, moved from Bitget-labeled wallets into a freshly created address in roughly an hour.

That number turned out to be badly low. Bitget later said on-chain trackers hadn't captured activity across every affected blockchain. The final tally:

  • Total loss: $351.6 million
  • Transfers: 19 unauthorized transfers from parts of the hot and warm wallet layers
  • Assets taken: ETH, USDT, USDC, BNB, AVAX and XAUT (Tether's gold-backed token)
  • Cold wallets: Untouched, according to Bitget

The attacker moved fast to launder the haul, swapping tokens at prices well away from spot and bridging them to other chains. One fresh wallet bought 7,111 ETH on Arbitrum in about six minutes using 19.67 million USDT0 from a Bitget hot wallet, paying up to 5% over market price. That's the behaviour of someone who cares about speed, not slippage.

How the Attack Worked: Spoofed Transfers, Not Stolen Keys

The most important detail so far is what the hackers didn't get. According to Chen, the attacker compromised a critical backend system inside Bitget's wallet infrastructure, used it to fake transaction data, and tricked the exchange's own authorization-signing process into approving the withdrawals.

"Private key compromise has been ruled out," Chen wrote.

Why that matters: a stolen private key lets an attacker keep signing transactions until the funds are moved elsewhere. A spoofed-request attack can be shut down once the compromised system is isolated. Bitget says it has stopped further unauthorized transfers.

It's also an uncomfortable echo of Bybit's record $1.5 billion hack in February 2025, where attackers didn't break the cryptography either. They manipulated what signers saw and approved. The weak point keeps turning out to be the systems around the keys, not the keys themselves.

The North Korea Link

Speaking to CNBC on Friday, Chen said investigators had identified IP addresses tied to VPN services previously used by a North Korean hacking group. She stressed the evidence is preliminary and the investigation is ongoing.

If confirmed, it would add to a long list of exchange breaches attributed to DPRK-linked groups, including the Bybit hack. Bybit CEO Ben Zhou said his team was standing by to help Bitget, returning the favour after Bitget supported Bybit through its own crisis last year.

Are User Funds Safe?

Bitget's answer is yes, and on paper the numbers back it up:

  • User Protection Fund: more than $464 million, comfortably above the $351.6 million loss
  • Company assets: Chen says over $1 billion in additional assets back user balances 1:1
  • Architecture: Bitget runs a three-tier wallet system and says the breach was contained to part of the hot and warm layers

What's still restricted:

  • Withdrawals are suspended "as a precautionary measure, pending security review"
  • Deposits and trading remain open
  • No date has been given for withdrawals to reopen

Chen also promised a full incident report within 24 hours of the breach. Until that report lands and withdrawals come back online, "funds are safe" is a promise, not something users can verify for themselves.

Market Reaction

Bitget's native token BGB dropped sharply as the news spread Thursday night before recovering part of the move, trading about 2.9% lower late in the evening UTC, according to CoinDesk. The wider market largely shrugged it off, which says something about how routine nine-figure exchange hacks have become.

The Bigger Picture: September Is 2026's Worst Month for Crypto Theft

Bitget's breach tops the $320 million Liquid Network exploit from earlier this month and April's KelpDAO and Drift Protocol incidents, each in the $285 million to $292 million range.

According to a CryptoSlate tally, Bitget's loss pushes September's total crypto theft above $684 million, overtaking April as the most expensive month of the year. Two of September's biggest incidents hit infrastructure, a sidechain and an exchange backend, rather than DeFi smart contract bugs. Attackers appear to be focusing on the centralized layer, where one weak system can expose far more value than any single contract.

What Should Bitget Users Do?

  • Don't panic-trade into illiquid pairs. Trading is live but withdrawals aren't, so you can't move out anyway.
  • Only trust official channels. Hacks attract phishing. Ignore DMs, "refund" links and fake support accounts offering early withdrawals.
  • Watch for the incident report. It should clarify how the backend was breached and when withdrawals return.
  • Rethink exchange exposure. Once withdrawals reopen, consider keeping only trading balances on any centralized exchange and holding the rest in self-custody.

The Bottom Line

Bitget looks set to absorb a $351.6 million loss without touching customer balances, thanks to a protection fund built for exactly this. That's a better outcome than most hacks produce. But the attack itself is the real warning: no keys were stolen and no cryptography was broken. A single compromised backend system was enough to convince a top-10 exchange to sign away a third of a billion dollars.

For now, the questions that matter are when withdrawals reopen and what the incident report reveals. We'll update this story as Bitget shares more.

 

Sources

Disclaimer: This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry risk. Always do your own research. See our Financial Disclaimer for details.