Key Takeaways
Bitget confirmed attackers stole about $387.5 million from its hot and warm wallets on September 24, one of the largest crypto exchange hacks of 2026.
The attackers spoofed Bitget's backend transaction data rather than stealing private keys, moving roughly 103 million XRP and other tokens across at least five blockchains.
CEO Gracy Chen said Bitget's $464 million User Protection Fund will cover the full loss, and the exchange suspects North Korea-linked hackers.
Bitget, one of the largest cryptocurrency exchanges, confirmed on September 24 that attackers drained about $387.5 million from its hot and warm wallets, one of the largest crypto exchange hacks of 2026. The exchange first flagged unusual activity at 18:31 UTC, put the early loss near $183 million, then raised the figure to $351.6 million before landing on $387.5 million.
The most notable part of this is how the money left. According to Bitget, the attackers did not steal private keys. They reached the backend wallet infrastructure and spoofed transaction data so the authorization system approved fraudulent transfers on its own. About 103 million XRP worth roughly $157 million went out, along with stablecoins, ether, and other tokens spread across at least five blockchains.
Bitget said customer balances are safe. CEO Gracy Chen said the exchange's User Protection Fund, which holds more than $464 million, will cover the full loss, and Bitget paused withdrawals for about a day while it built a recovery plan and brought in the security firms Mandiant and SlowMist to trace the funds. It also opened a bounty for help recovering the stolen assets.
Chen pointed to North Korea, saying some attacker IP addresses matched the VPN patterns of a known state-linked group and that the overall approach resembled earlier North Korean operations, an attribution outside analysts have echoed. North Korean crews have stolen billions from crypto platforms to fund the regime.
The pattern here is hard to ignore. An exchange that has to trust its own internal authorization system is exactly the single point of failure that on-chain, verifiable settlement is meant to remove, the same accountability gap running through the DOJ's sanctions probe into Binance and the record stablecoin flows Chainalysis tracked this year. Worth watching whether the funds move.
People Also Ask
How much did the Bitget hack cost?
Bitget confirmed a loss of about $387.5 million on September 24, 2026, after early estimates of $183 million and $351.6 million.
How did the Bitget breach happen?
Attackers reached Bitget's backend wallet infrastructure and spoofed transaction data to trick its authorization system into approving fraudulent transfers, rather than stealing private keys.
Will Bitget users get their money back?
Bitget CEO Gracy Chen said the exchange's User Protection Fund, which holds more than $464 million, will cover the full loss and keep customer balances intact.
Who is behind the Bitget hack?
Bitget and outside analysts suspect North Korea-linked hackers, citing attacker IP addresses that matched a known state group's VPN patterns and tactics seen in earlier attacks.