TLDR
Crypto exchange Bitget has confirmed a hack that drained about $351.6 million from its hot and warm wallets, while saying user balances are covered by its protection fund.
- Bitget detected unauthorized transfers from hot and warm wallets totaling roughly $351.6 million and has paused withdrawals while keeping trading and deposits open.
- The loss is being covered by Bitgets more than $464 million User Protection Fund, but a large share of the stolen assets has been converted into Ether and XRP, creating liquidity risk.
- Investigators are probing a backend wallet compromise and possible North Korean involvement, with a promised incident report and withdrawal timeline still pending.
Deep Dive
1. What Happened At Bitget
On September 24, 2026, Bitget reported unauthorized transfers from parts of its hot and warm wallet infrastructure, putting the loss at about $351.6 million in crypto assets, and immediately suspending withdrawals while keeping deposits and trading live. Multiple reports note that the funds moved out of Bitget-linked wallets in a series of 19 transactions detected at 18:31 UTC, with cold wallets said to be unaffected and offline storage intact. Bitget and external coverage emphasize that the exchange operates a three tier wallet system and that the breach was confined to the online layers that support day to day operations, not the offline vaults that hold most reserves.
CEO Gracy Chen and subsequent technical summaries say attackers compromised a backend system in the wallet infrastructure, spoofed transaction data and triggered Bitgets internal authorization process rather than stealing private keys, with Chen explicitly stating that private key compromise has been ruled out in explanations of the incident on X and in media interviews.
2. Impact On Users And Markets
Bitget has stated that the entire $351.6 million shortfall is covered by its User Protection Fund, which held more than $464 million before the incident, meaning customer account balances and assets on the platform are expected to remain whole despite the hack and withdrawal pause. This fund is separate from the exchanges Proof of Reserves reporting and is designed as a capital buffer for precisely these kinds of events, allowing Bitget to absorb the loss rather than passing it on to users.
On chain analysis shows that a large portion of the stolen assets has been converted into Ether and XRP, with reports citing tens of thousands of ETH and over 100 million XRP now sitting in attacker controlled addresses after swaps from stablecoins and other EVM chain assets. That concentration creates potential liquidity and price pressure if the attacker attempts to offload those holdings across exchanges or DEXs, particularly in thin markets or during broader risk off periods.
If you use Bitget, the main immediate impact is frozen withdrawals rather than balance loss, but the attackers large ETH and XRP stash is a risk factor to monitor across venues.
3. What To Watch Next
Bitget has engaged law enforcement and on chain security firms and committed to publishing a full incident report with root cause analysis and corrective actions. Until that report is out and withdrawals resume, operational risk remains elevated, even if balances are nominally covered.
Investigators and some on chain analysts have flagged similarities between this attack and prior operations linked to North Koreas Lazarus Group, including IP addresses tied to specific VPN services, but both Bitget and external media stress that attribution is still unconfirmed. Clearer attribution and recovery progress, plus concrete changes to Bitgets backend and wallet controls, will be key signals for how trust in the exchange and in centralized platforms more broadly evolves after one of the largest exchange hacks of 2026.
Across exchanges, users may increasingly focus on proof of reserves, dedicated protection funds and detailed incident reporting as practical filters for where they are comfortable holding significant balances.
Conclusion
The Bitget hack highlights that even exchanges with robust cold storage and large protection funds can be vulnerable when backend systems are compromised and transaction flows are spoofed. In the near term, Bitget users face operational disruption rather than direct balance loss, while the wider market has to absorb a large attacker controlled pool of ETH and XRP. How quickly withdrawals reopen and how transparently Bitget explains and fixes the breach will shape both its own reputation and broader expectations for centralized exchange security in the months ahead.
CoinsKid.Com