USD
Bitget Hack Hits $351.6 Million as Exchange Freezes Withdrawals
Exchange says protection fund can cover losses as investigation points toward possible DPRK link
TL;DR
- Bitget said unauthorized transfers detected on September 24, 2026, affected about $351.6 million across parts of its hot and warm wallet systems.
- Withdrawals were suspended while deposits and trading remained operational, with Bitget saying its User Protection Fund could cover the loss.
- Gracy Chen later said the incident was highly likely linked to North Korean hackers, though the attacker’s identity could not be confirmed with 100% certainty.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Bitget said unauthorized wallet transfers detected on September 24, 2026, affected about $351.6 million in assets, prompting the exchange to suspend withdrawals while keeping deposits and trading operational. The breach was limited to portions of Bitget’s hot and warm wallet infrastructure, while cold wallets and most platform assets were not affected.
Bitget said its security systems detected the suspicious transfers at 18:31 UTC and activated an emergency response process within minutes. The exchange began identifying addresses that received the unauthorized transfers and later contacted law-enforcement authorities and blockchain security companies for assistance.
An initial on-chain estimate from Bubblemaps put the drained amount at roughly $192 million across different networks. That early tracking covered 15 transfers involving seven assets, with Ethereum representing 44.4% of the observed amount. The transfers included Ether, BNB, Avalanche, Tether, USDC and gold-backed XAUT, with some assets first sent to one address and later distributed among several others.
Bitget’s broader estimate later rose to about $351.6 million. The exchange had not provided a complete list of every affected wallet at that stage, and the reason for the difference between the early on-chain estimate and the larger figure remained unresolved.
XRP and ETH dominate later asset breakdown
A later update from Lookonchain provided a more detailed breakdown of the assets affected by the breach.
The stated values in the later breakdown total about $356.85 million. XRP accounted for roughly 44% of that listed value, while ETH represented about 24%. Together, the two assets were valued at approximately $243.23 million, or about 68% of the later breakdown.
USDT, USDC and USDt0 had a combined stated value of about $75.47 million. XAUt, BNB, AVAX and TRX together accounted for another approximately $38.15 million. The information provided did not definitively reconcile the different valuation snapshots.
Protection fund and solvency assurances
Bitget said user balances remained accurate and that its User Protection Fund would cover the incident. The fund was initially stated at more than $464 million, putting the estimated loss at about 76% of its declared value.
Gracy Chen, Bitget’s Chief Executive Officer, said, “The full amount of this loss falls within the coverage of Bitget's User Protection Fund.”
A later update put the protection fund at more than $465 million. During a livestream, Gracy also said Bitget held more than $1 billion in proprietary capital in addition to the fund.
Gracy rejected comparisons with FTX, saying Bitget was certainly not “another FTX” and could handle a potential run on withdrawals. She said Bitget’s retail business was comparable in scale to Bybit’s and argued that if Bybit could withstand a $1.5 billion loss, Bitget could absorb a loss of more than $300 million.
Withdrawals remained suspended during the security review, while deposits and trading continued. Bitget said withdrawals would return once the exchange considered reopening safe.
Investigation points toward possible North Korean link
The technical cause of the breach had not been established during the initial response. Bitget said the root cause remained under investigation and did not publicly identify an attack method at that stage.
Gracy later said the attacker’s identity could not be confirmed with 100% certainty but that the incident was highly likely linked to North Korean hackers. She said certain IP addresses closely matched VPN patterns used by a group associated with the DPRK.
Bitget said it had flagged addresses linked to the unauthorized transfers and sought assistance from law enforcement and blockchain security companies. The information provided did not establish how much of the stolen cryptocurrency, if any, had been frozen or recovered.
Gracy said Bitget would provide regular or hourly updates and committed to publishing a full incident report within 24 hours covering the cause of the breach, the exchange’s response and corrective measures. She also pledged that “every dollar and every decision will be accounted for, transparently and in full.”
September crypto losses rise above previous 2026 high
The breach occurred during Bitget’s eighth-anniversary campaign in September 2026, when the exchange was promoting an expansion beyond conventional crypto trading into equities, foreign exchange and other markets under its Universal Exchange strategy.
Before Bitget’s breach was added, about $331 million in losses had been recorded across 17 September incidents, with later incidents pushing that figure above $342 million. Roughly $320 million of the earlier monthly damage was linked to an incident involving Liquid Network.
Adding Bitget’s estimated losses pushed September’s reported gross crypto losses above $684 million, making it the costliest month of 2026 on a gross-loss basis at that point.
That total surpassed April 2026, when crypto exploits generated about $646.9 million in losses. Approximately $577 million of April’s total was attributed to the Drift and KelpDAO incidents.
The September gross-loss figure remained provisional because investigations could still determine whether compromised assets were recovered or whether all affected funds ultimately became permanent losses.
This article has been refined and enhanced by ChatGPT.
