TLDR
Crypto exchange Bitget has suffered a roughly $351.6 million hack from its wallet infrastructure, but says all user balances are covered by a $464 million protection fund.
- Bitget reports unauthorized transfers from hot and warm wallets around 18:31 UTC on 24 Sep, pausing withdrawals while keeping deposits and trading online and asserting user funds remain intact.
- The theft spans multiple chains and assets, with a large portion converted into native coins like ETH and XRP that are difficult or impossible to freeze, highlighting centralized custody risks.
- Bitget and external investigators are probing a suspected North Korean link and the exact backend exploit, with users awaiting a full incident report and a timeline for withdrawal resumption.
Deep Dive
1. What Happened And Bitgets Response
Bitget confirmed that about $351.6 million was drained via unauthorized transfers from parts of its hot and warm wallet infrastructure on 24 Sep 2026 at 18:31 UTC, triggering emergency procedures within minutes. The exchange says its offline cold wallets were untouched and that the loss is fully covered by a User Protection Fund holding over $464 million.
CEO Gracy Chen has stated that customer account balances remain accurate, deposits and trading continue, but withdrawals are temporarily suspended while a security review and full technical report are completed. Bitget has flagged attacker addresses and engaged law enforcement and on-chain security firms to track the funds.
Operationally, trading on Bitget continues, but you cannot withdraw until the review is complete, so venue risk (ability to exit) is elevated in the short term.
2. Assets, Chains And Custody Risk
Reports indicate the theft spanned XRP, ETH, stablecoins such as USDT and USDC, tokenized gold (XAUt), BNB, AVAX, TRON and others, across networks including Ethereum, XRP Ledger, BNB Chain, Avalanche, Arbitrum, Optimism and Base. A large share of EVM assets was consolidated and swapped into roughly 68,000 ETH, worth around $180 million, making on-chain clawback difficult because native assets cannot be frozen by issuers.
By contrast, portions of stolen stablecoins may be frozen at issuer level, but analysts note that about three quarters of the haul is in assets that no party can unilaterally seize or reverse, underscoring the limits of post-hack recovery.
Even with a protection fund, a centralized exchange remains a single point of failure; recovery for the platform is mostly a balance-sheet issue, but the on-chain loss is structurally hard to unwind.
3. Suspected North Korean Link And What To Watch
Bitget and several media outlets report that investigators found IP addresses linked to VPN services previously associated with North Korean hacking groups, with attack patterns resembling prior Lazarus Group operations, though attribution remains officially unconfirmed pending the incident report Bitget plans to publish.
Technically, Bitget says private keys were not compromised; instead, attackers exploited a backend wallet system, spoofed transaction data, and abused Bitgets own authorization process to sign transfers. This shifts focus from key storage toward application and internal system security. Key next signals are: the root-cause analysis, changes Bitget makes to its wallet architecture, any coordinated industry response, and the timeline for restoring withdrawals.
For crypto users, watching how exchanges harden backend systems (not just cold storage) and how quickly they transparently resolve such incidents is critical when assessing venue risk.
Conclusion
A roughly $351.6 million hack at Bitget shows that even large exchanges with sizable protection funds can be compromised at the infrastructure level, turning a technical flaw into a major balance-sheet event. User balances are reportedly covered, but the pause on withdrawals and the difficulty of recovering native assets highlight why custody choice, exchange transparency and incident response quality are as important as asset selection in crypto.
CoinsKid.Com