Bitget (hot and warm wallet breach) hack — September 2026

Bitget, a centralised exchange, lost about $387.5m from part of its hot and warm wallet infrastructure on 24 September 2026. Its systems flagged the unauthorised transfers at 18:31 UTC. Cold wallets were not touched. Bitget first put the loss at $351.6m and raised it on 25 September, after on-chain tracing found Zcash and Tron transfers made during the original incident that the first count had left out; it said no further unauthorised transfers had taken place. It suspended withdrawals while keeping deposits and trading open, and says customer balances are unaffected because the loss falls within its User Protection Fund, which it put at more than $464m, held as 5,500 BTC, when the incident was disclosed. Blockhead described it as the largest breach of a centralised exchange so far this year.

Bitget's first account, given by chief executive Gracy Chen on 25 September, was that the attacker had compromised a backend system in the wallet infrastructure and used it to feed forged transfers through the exchange's own authorisation process; private-key compromise was ruled out. Interim reports by Mandiant and SlowMist, which Bitget published on 30 September, show how the system was entered. SlowMist found the earliest malicious activity in logs dated 31 August, when a zero-day vulnerability in a service on a node of a third-party security product let the attacker run a hidden script and read a database password; the same activity recurred on two more nodes on 23 and 25 September. At about 16:07 UTC on 24 September the attacker used an internal employee's identity to reach the management platform of a second security product and inject commands, and Mandiant describes a web shell and command-and-control channel on that appliance, used to move onto Bitget's production wallet job server and install malicious packages. From files the attacker had deleted, SlowMist recovered a withdrawal tool tailored to Bitget's wallet logic that forged risk-control parameters; it began running at 17:49 UTC. The signing keys held. What failed were the systems trusted to tell them what to sign.

According to a breakdown by the on-chain tracker Lookonchain, reported by Blockhead, the stolen assets span nine tokens: 102.93 million XRP (about $157.5m), 31,890 ETH ($85.8m), roughly $75.5m in USDT, USDC and USDT0, 3,000 XAUt, 12,719 BNB, 821,012 AVAX and 20.59 million TRX. That comes to about $357m at 25 September prices and includes no Zcash; Bitget's revised $387.5m, which adds the Zcash and Tron assets its first count missed, is the figure recorded here. SlowMist tied the theft to eleven EVM addresses, seven XRP Ledger addresses and one Tron address, and reported the attacker converting EVM-chain assets into ETH. Bitget's own list, updated on 30 September, names 13 assets across 11 blockchains taken from 12 hot and warm wallet addresses, adding ATOM, ALGO and TIA, and puts the total at about $388m.

Two blockchain analytics firms have linked the theft to North Korea. Elliptic said on 25 September that it was highly likely to be DPRK-linked, citing on-chain connections between the stolen XRP and ether from an earlier DPRK-attributed theft, first reported by the on-chain investigator Specter, and between the stolen funds and addresses used to launder earlier DPRK-attributed thefts, including the 2025 Bybit hack. Specter also linked the routing of the stolen XRP to funds from the July 2026 AFX Trade hack recorded elsewhere in this registry. On 1 October Chainalysis, which says it has been working with Bitget and law enforcement partners to trace the funds, described the attack as DPRK-attributed. Chen said in a livestream that some IP addresses used in the attack closely matched VPN patterns associated with a North Korea-linked group, while stressing that this was not confirmed. The Mandiant and SlowMist reports of 30 September do not attribute the attack, Chen told CNBC on 2 October that further details were still needed, and no government has attributed it, so the attribution is recorded as alleged.

The first on-chain transfer came at 18:31 UTC and, by SlowMist's count, the last at 21:23 UTC, almost three hours later. Bitget's reconciliation system caught the discrepancy at 19:05 UTC and blocked withdrawal requests, but the transfers ran on until 21:23; after that the attacker tried and failed to push two fabricated bitcoin withdrawals through the wallet database. Bitget reopened withdrawals in phases, each at 08:00 UTC: bitcoin on 28 September, ether on Ethereum, BNB Chain, Arbitrum, Base and Optimism on 29 September, USDT on Ethereum, BNB Chain, Solana and Tron on 30 September, and all remaining tokens, fiat and C2C trading on 2 October, which Bitget said completed the phased plan. On 30 September Bitget said it had restored its Protection Fund to more than $300m with its own capital; by Bloomberg's calculation from the fund's disclosed addresses, covering the loss had drawn it below $200m. Recovery is limited. Chen told CNBC on 2 October that about $1.1m had been frozen, which is not the same as returned, and that she was not expecting to recover a lot; NEAR Intents had separately said it froze about $503,000 and blocked more than $50m of attempted transfers, which then moved through other routes. On 2 October the compliance firm AMLBot reported that about $697,000 had been stranded when the attacker sent about 267,000 USDC and 160 ETH to Chainflip deposit channels on the wrong networks; Circle has since blacklisted the address holding the USDC, and no contract on Arbitrum can sweep the ETH. Frozen and stranded funds are not recorded as recovered. With withdrawals open again in full and the loss absorbed by Bitget, the outcome is recorded as users reimbursed; none of the stolen assets has been recovered.