At 18:31 UTC on 24 September 2026, Bitget’s security systems detected unauthorized transfers leaving some of its hot wallets. By the time the exchange published a notice three hours later, the figure it put on the incident was approximately $351.6 million [1][5].
That number is nearly double the $170 million to $183 million that independent blockchain researchers were estimating while the drain was still in progress, which is itself the most useful thing about this incident for anyone who has to make decisions on partial information [6]. The first public warning did not come from Bitget. It came from an on-chain researcher watching wallets move [3].
Status: developing. The figures below are Bitget’s own, published in its security notice and confirmed by its chief executive. The attack vector is unknown and the exchange has said it will not speculate before its investigation completes. Attribution claims circulating in the last few hours are not supported by published technical evidence, and are labelled as such below. This analysis reflects the public record as of 01:20 UTC on 25 September 2026, and was updated to record the chief executive’s latest statement, delivered during a live broadcast on X, in which Bitget linked its preliminary findings to a DPRK-linked group and confirmed that some funds have been recovered.
Figure 1. The public timeline in UTC. The exchange disclosed the incident about three hours after detection, and independent researchers were first to flag it.
What is confirmed, and what is not
| Item | Status | Detail |
|---|---|---|
| Funds affected | Confirmed by Bitget | Approximately $351.6 million in unauthorized transfers from hot wallets and part of the warm wallet layer [1] |
| Detection time | Confirmed by Bitget | 18:31 UTC on 24 September 2026 [1] |
| Cold wallets | Confirmed by Bitget | Stated to be fully secure and outside the breach, under a three-tier wallet architecture [1] |
| User funds | Confirmed by Bitget | Bitget states balances are accurate and the loss falls within its User Protection Fund, which it says holds over $464 million [1][9] |
| Withdrawals | Confirmed by Bitget | Suspended as a precautionary measure, with deposits and trading still operational [1] |
| Attacker’s entry path | Unknown | Bitget’s notice says it will not speculate on the attack vector. The CEO states that attackers breached Bitget systems and moved funds directly rather than forging customer withdrawal requests, and that investigators are still determining which systems were compromised [1][2][14] |
| User private keys | Stated by the CEO | Not obtained, and cold wallet keys not compromised [2] |
| Insider involvement | Not ruled out | Chen says the company does not currently believe an employee assisted, calls the possibility quite low, and states no evidence linking an employee has been published [2] |
| Attribution | Preliminary, unverified | The CEO says investigators identified IP addresses matching VPN choices associated with a DPRK group and that the pattern resembles prior North Korean operations. No technical artefacts supporting the attribution have been published by Bitget or by an independent firm [14][15][16] |
| Recovery | Partial | The CEO says some stolen funds have been recovered without specifying an amount, and that Bitget is working with blockchain foundations and other partners on recovery [14][15] |
| Protection fund composition | Unverified | The $464 million figure and the claim of full coverage are Bitget’s; the fund’s asset composition has not been independently verified [6] |
The two hours the exchange could not stop
The mechanics of the drain are worth following because they show how an exchange incident differs from a customer-account compromise. The first activity noticed publicly was a newly created wallet buying 7,111 ETH on Arbitrum within about six minutes, funded with 19.67 million USDT0 that came from a Bitget hot wallet, routed through UniswapX and 1inch Fusion and paying as much as five per cent above spot price [3]. Paying a premium for speed is what a drain looks like when the operator expects the counterparty to react.
Funds did not move in a single transaction or on a single chain. Assets leaving wallets labelled as Bitget’s included ETH, USDT, USDC, AVAX, BNB and XAUT, a gold-backed token, and on-chain records put the outflows between roughly 18:31 and 20:55 UTC [8], which means the movement continued for more than two hours after the exchange’s own systems flagged it [3][4]. Etherscan has since tagged the principal receiving address as Bitget Exploiter 1, and trackers have published the address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee for follow-up [4][7].
Two choices in that flow are standard practice for this kind of theft. Stablecoins were converted into ETH, because USDT and USDC are centrally issuable and can be frozen, while ETH cannot be frozen by any issuer [4]. And funds were bridged across chains, which breaks the single-chain trail into several partial ones. Neither step is exotic. Both are the reason that recovery in exchange breaches is rare and slow, and why the useful defensive work happens before the money leaves, not after.
Three tiers of wallets, and the one that mattered
Bitget describes its custody in three layers, and the incident maps onto them precisely enough to be instructive [1].
Figure 2. The architecture worked as designed: the offline layer was untouched. The loss still exceeded $350 million because that is how much was reachable in the online layers.
Hot wallets sign automatically and hold the float for daily operations. Warm wallets hold balances for larger or less frequent movements. Cold wallets keep keys off networked systems with separate signing. Bitget states that the breach was contained to hot wallets and part of the warm layer, and that cold wallets were untouched [1].
Read carefully, that is two separate claims: the deepest layer held, and the working layers were still carrying $351.6 million. For anyone designing custody or treasury controls, the second claim is the one to sit with. A cold layer protects savings; it does not protect the operational float that makes an exchange usable, and the float is exactly what an attacker with access to internal systems can move fastest.
There is also a distinction in the CEO’s account that is easy to collapse and should not be. Chen says user private keys were not obtained and that cold wallets were not compromised, while also describing a direct breach of Bitget’s systems rather than forged withdrawal requests from customer accounts [2]. Both can be true at once: an attacker can abuse internal wallet-management systems to authorize transfers without ever extracting the underlying keys. The public record does not yet say which happened, and Bitget has not claimed otherwise.
The protection fund, and the part nobody has verified
Bitget’s stated position is that the entire loss sits inside its User Protection Fund, which it says holds more than $464 million, leaving headroom of roughly $112 million over the stolen amount [1][2][9]. The exchange has not said whether it will draw on the fund immediately, how the fund’s value is calculated, or what the process looks like for customers [2]. One review of the incident makes the sharpest point available: the fund’s asset composition has not been independently verified [6].
That is not an accusation, it is a description of what a protection fund is. A fund is a promise backed by assets, and the promise and the assets are different things. Bitget does publish monthly Merkle tree proofs of reserves with a stated reserve ratio, and those snapshots are the right instrument for checking the claim, provided you read them as point-in-time statements rather than continuous guarantees [10].
The other consequence of the incident is easier to verify and applies to everyone: withdrawals were frozen for all users, including users whose assets were never touched [6]. When a custodial platform discovers a loss, access stops platform-wide. That is the practical meaning of counterparty risk, and it happened here in real time on a platform that says customer funds are safe.
The chief executive’s latest statement: IP clues, direct transfers and a partial recovery
In a live broadcast on X after the incident, chief executive Gracy Chen added detail that moves the attribution question forward without settling it. She said investigators had identified some IP addresses that match the VPN choices used by a certain DPRK group, and that the pattern looks very much like what the North Korean team did before [14][15].
She also described the mechanics of the theft in terms that matter for how the industry learns from it. The attackers breached Bitget’s systems and moved funds directly, she said, rather than forging customer withdrawal requests, and they did not obtain the private keys of the cold wallet or of any hot or warm wallet [14][16]. Investigators were, at the time of the broadcast, still working out which systems were compromised and how access was obtained [15].
Two further points from the statement will be tested against later disclosures. Chen said the exchange does not believe the breach involved an inside job, and she said some stolen funds have already been recovered, without giving an amount, with recovery work continuing alongside blockchain foundations and other partners [14][15]. For scale on the attribution claim, North Korean hackers were linked to an estimated $2.02 billion in crypto theft during 2025, including the approximately $1.5 billion Bybit breach that the FBI attributed to North Korea [14][17].
| Statement | What it tells defenders | Status |
|---|---|---|
| IP addresses matching VPN choices associated with a DPRK group | Attribution is being built on infrastructure correlation and behaviour rather than recovered tooling, which is a normal starting point and not a conclusion | Preliminary finding disclosed by the company, no published artefacts [14][15][16] |
| Attackers transferred funds directly rather than forging withdrawal requests | Points at compromise of internal systems or signing paths rather than customer-account fraud, and explains why a withdrawal freeze was the first containment step | Stated by the chief executive, no technical write-up yet [14][16] |
| No private keys obtained for cold, hot or warm wallets | Suggests authority was abused through internal systems rather than key material extracted, which changes the remediation path entirely | Stated by the chief executive, consistent with the cold-layer claim in the notice [1][14] |
| Investigators still determining which systems were compromised | Scope is open, so treat any statement about containment as provisional | Stated by the chief executive [15] |
| Some stolen funds recovered, amount undisclosed | Recovery is possible when funds touch cooperating venues, but without a figure the coverage claims remain unquantified | Stated by the chief executive [14][15] |
What is genuinely unknown
Three questions are open, and the difference between them matters for how the story gets retold over the coming days.
- The attack vector. Bitget’s notice is explicit that it will not speculate before the investigation completes, and that a full incident report including root cause analysis and corrective actions would follow within 24 hours of the notice [1]. Until that lands, any confident explanation of how the attacker got in is speculation.
- Whether an insider assisted. The CEO says the company does not currently believe an insider was involved, calls the possibility quite low, notes Bitget employs around 2,000 people, and confirms that no evidence linking an employee has been published [2]. Not ruled out is not the same as suspected, and the honest reading is that the question is open.
- Attribution. The company now points at a DPRK-linked group on the basis of IP addresses matching VPN choices and behavioural similarity, which is more than was on the record the day before and still short of a finding [14][15]. That group, tracked as TraderTraitor and UNC4899, is the actor the FBI attributed the approximately $1.5 billion Bybit theft to in February 2025 [17], and we covered the developer-targeting playbook behind that intrusion in a separate analysis. Prior form is not evidence in a specific case, so until Bitget or an independent firm publishes the correlation, the attribution remains a company statement.
Context: a costly month in a costly year
This is the largest confirmed exchange security incident of 2026 so far, and it lands days after another nine-figure loss in the same month: the Liquid Network, a Bitcoin sidechain used quietly by exchanges for settlement, lost roughly $320 million worth of bitcoin on 6 September 2026 and halted transactions [11][12]. Across 2025, hackers stole a combined $2.72 billion from exchanges and protocols, and the single largest theft on record remains the Bybit breach at approximately $1.5 billion as the FBI characterised it [3][13].
The pattern across those incidents is not a repeated bug. It is a repeated shape: a custodial platform with a large operational float, an attacker who reaches the systems that authorize movement, and a containment decision made in public. The variable that changes is how much was in reach at the moment of access.
What this means for organisations holding digital assets
Most enterprises that touch digital assets are exposed to an exchange through exactly one relationship: they keep a balance there and can stop using it when they want to, except when they cannot. Six controls follow from this incident.
- Record the counterparty, not the account. An exchange balance is a claim on an institution, not an asset in your possession. It belongs in the third-party risk register with a stated tolerance, an owner and a review date, the same as any other critical supplier [6].
- Size the float deliberately. Decide how much working capital a given venue needs for settlement and liquidity, hold it there, and keep everything else outside that venue or in self-custody with a documented key-management process. The Bitget breach reached the online layers because that is where the money was [1][2].
- Watch your custodian’s labelled wallets yourself. The first public signal in this incident came from an independent researcher noticing a fresh wallet buying ETH on Arbitrum, not from the exchange [3]. Monitoring your custodian’s known addresses is cheap, and it can give you hours of warning before a notice is published.
- Write the freeze playbook before you need it. Assume that a loss at your venue means you cannot withdraw, that customer support will be slow, and that a security review will gate resumption [1][6]. Decide in advance who can authorize a move to another venue, what the limits are, and how you would pay obligations if a venue is closed for a week.
- Verify protection funds and reserves yourself. A fund claim is a promise until you have read the instrument behind it. Monthly proof-of-reserves snapshots are a starting point and are point-in-time; composition, custody arrangements and the conditions attached to coverage are the questions that decide whether the promise holds [6][10].
- Keep your own incident process for a vendor event. Your response is not Bitget’s response: your obligations are to your own balances, your own obligations to others, and your own audit trail of what you knew and when. Log the detection time, the notice, the withdrawal freeze and every action you took, because that record is what you will be asked for later [1].
What to watch next
- The incident report Bitget said would follow within 24 hours, which should carry the root cause analysis and corrective actions [1].
- Any resumption of withdrawals, and whether it arrives with a published security review rather than an announcement [1][2].
- Movement of the flagged addresses, and whether the ETH consolidates, bridges again or reaches a mixer [4][7].
- The next proof-of-reserves snapshot and reserve ratio, which is where the protection fund claim meets a number [10].
- Any published technical evidence for the DPRK attribution, since the IP and VPN correlation described by the chief executive has not been released [14][15]
- A quantified recovery figure, and whether recovered funds came back through cooperating venues or from the attacker [15]
Our own daily threat digest recorded this incident as its top entry on 25 September, grouping the first-wave reporting with the confirmed figure as the story developed through the evening of 24 September.
Sources
- Bitget Support, “[SECURITY NOTICE] Bitget Hot Wallet Incident, September 24, 2026” (24 September 2026), the exchange’s primary statement: detection at 18:31 UTC, approximately $351.6 million affected, cold wallets secure, User Protection Fund coverage and suspended withdrawals. · https://www.bitget.com/support/articles/12560603896024
- Hackread, “Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group” (25 September 2026), covering the CEO’s live broadcast: direct breach of Bitget systems, no user private keys or cold wallet compromise, the insider assessment, the unverified attribution claim and the fund headroom. · https://hackread.com/bitget-hack-suspects-north-korea-lazarus-group/
- Decrypt, “Bitget Hacked as $350 Million Vanishes From Crypto Exchange Wallets” (24 September 2026), including the on-chain researcher’s first public flag, the Arbitrum ETH purchase detail, the assets moved and the 2023 protection fund history. · https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets
- Unchained, “Bitget’s Hot and Cold Wallets Hit in Suspected Hack Worth More Than $180 Million” (24 September 2026), for the on-chain outflow window, the Etherscan tag on the receiving address, and the conversion of stablecoins into ETH and cross-chain bridging. · https://unchainedcrypto.com/bitgets-hot-and-cold-wallets-hit-in-suspected-hack-worth-more-than-180-million/
- CoinDesk, “Crypto exchange Bitget says $352 million affected in a hack, claims user funds are safe” (24 September 2026). · https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe
- TFTC, “Bitget Loses $351.6M in Hot Wallet Breach, Withdrawals Frozen” (24 September 2026), for the gap between early estimates and the confirmed figure, the platform-wide withdrawal freeze, and the note that the protection fund composition is not independently verified. · https://www.tftc.io/bitget-351-million-hot-wallet-hack-withdrawals-frozen
- CoinGape, “Crypto Exchange Bitget Exploited for $350M as Hacker Swaps Funds for Ethereum”, for the published tracking address for the receiving wallet. · https://coingape.com/crypto-exchange-bitget-exploited-for-350m-as-hacker-swaps-funds-for-ethereum/
- Bitcoin Magazine, “Nearly $352M Moved From Crypto Exchange Bitget Wallets” (24 September 2026). · https://bitcoinmagazine.com/news/bitget-suffers-352-million-hack
- Bitcoin.com News, “Bitget Hit by $351M Hack, Withdrawals Frozen as Probe Begins” (24 September 2026), for the protection fund figure and the promised incident report. · https://news.bitcoin.com/security/bitget-hit-by-351m-hack-withdrawals-frozen-as-probe-begins/
- Bitget, Proof of Reserves, describing the monthly Merkle tree proofs, published reserve ratios and asset snapshots used to support reserve claims. · https://www.bitget.com/proof-of-reserves
- CoinDesk, “Bitcoin Network Used by Exchanges Hit by $320 Million Exploit” (7 September 2026), on the Liquid Network incident earlier in the same month. · https://www.coindesk.com/markets/2026/09/07/bitcoin-network-used-by-exchanges-hit-by-usd320-million-exploit-hackers-claim-they-re-the-good-guys
- Halborn, “Explained: The Liquid Network Hack, September 2026”, for the technical summary of that incident. · https://www.halborn.com/blog/post/explained-the-liquid-network-hack-september-2026
- FBI Internet Crime Complaint Center, PSA “North Korea Responsible for $1.5 Billion Bybit Hack” (26 February 2025), the attribution context for claims made about this incident. · https://www.ic3.gov/PSA/2025/PSA250226
- Cointelegraph, “Bitget CEO suspects North Korea behind $352M hack, citing IP clues” (25 September 2026), reporting the chief executive’s remarks during a live Q&A on X, including the IP and VPN correlation, the direct-transfer mechanics and the partial recovery. · https://cointelegraph.com/news/bitget-ceo-suspects-north-korea-behind-352m-hack-citing-ip-clues
- CryptoBreaking News, “Bitget CEO Says $352M Hack May Involve North Korea, Citing IP Clues” (25 September 2026), corroborating the same broadcast. · https://www.cryptobreaking.com/bitget-ceo-says-352m-hack/
- Payments High Risk, “Bitget CEO points to North Korea after $351.6 million hack, citing IP and VPN clues” (25 September 2026), corroborating the quotes and the statement that investigators were still determining which systems were compromised. · https://paymentshighrisk.com/bfe7d719-80b2-4757-8c74-ac5d1a62812a/
- Gracy Chen, the security notice as published on X by the Bitget chief executive (24 September 2026). · https://x.com/GracyBitget/status/2103235655879074084
The reading that will hold up
Two claims will survive this week and one probably will not. The claims that hold are that a custodial exchange lost approximately $351.6 million from its online wallet layers, and that its own systems detected the movement while it was still happening and still could not stop it within the hour. The claim that may not hold is anything definitive about who did it or exactly how. The company now points at a DPRK-linked group on infrastructure evidence it has described but not published, and its own investigators were still working out which systems were compromised at the time of the chief executive’s broadcast [14][15].
For anyone whose exposure to this incident is a balance on a platform, the practical lesson is not about Bitget specifically. It is that access to your funds can stop for reasons that have nothing to do with your account, and the time to decide how you would respond is while withdrawals are still working.