TLDR
Crypto exchange Bitget has confirmed a security breach that drained around $351.6 million in crypto from parts of its wallet infrastructure.
- Bitget reports a $351.6 million hot wallet breach affecting hot and warm wallets, while cold wallets and user balances are said to remain intact.
- The attack appears to have exploited a backend wallet system, not private keys, and preliminary evidence points to North Korean state-linked hackers, though attribution is still unconfirmed.
- Withdrawals are paused but trading and deposits continue; the loss is reportedly covered by Bitgets $464 million User Protection Fund, and the incident may sharpen scrutiny of centralized custody risk.
Deep Dive
1. Scale Of Loss And User Impact
Bitget says abnormal transfers were detected at 18:31 UTC on 24 Sep, ultimately totaling about $351.6 million across assets such as ETH, XRP, USDT, USDC, BNB, AVAX and TRX. Reports note that at least $228 million was drained in just 18 minutes across seven chains, highlighting how fast exchange-connected wallets can be emptied once a system is compromised.
The exchange states that only hot and warm wallets were touched, with cold wallets remaining secure, and that all losses fall within a User Protection Fund holding more than $464 million. Trading and deposits are still live, but withdrawals are suspended while a security review and incident report are completed.
If you use Bitget, your balance should remain whole on paper, but you cannot withdraw until the platform finishes its investigation and reopens outflows.
2. How The Attack Worked And Who Is Suspected
Bitget and multiple reports say attackers compromised a critical backend system tied to the exchanges wallet management, spoofing transaction data so Bitgets own authorization process signed off on fraudulent transfers. The company stresses that private keys for hot, warm or cold wallets were not stolen, which narrows the failure to internal infrastructure and controls rather than core key storage.
On-chain investigators and Bitgets CEO have flagged IP patterns and attack signatures consistent with North Korea-linked groups such as Lazarus, and CNBC reports Bitget suspects North Korea in the $352 million hack. However, Bitget has stopped short of formal attribution pending a full technical report.
Even without key theft, compromised backend systems can effectively bypass safeguards, so exchange-side operational security is as critical as key management.
3. Broader Market And Security Implications
This is one of the largest confirmed centralized exchange breaches of 2026 and the biggest single crypto theft reported so far this year, adding to a multi-year pattern of large, exchange-linked losses. Other venues are already reacting, with Binance rolling out enhanced wallet signature-risk screening shortly after the Bitget incident, underlining sector-wide concern about similar attack paths.
For markets, the direct hit is on Bitgets treasury and reputation rather than on a single asset, but repeated exchange hacks can weaken confidence in centralized custody overall and push more volume toward venues seen as better-audited or toward self-custody.
The hack is a reminder to treat exchanges as trading venues, not long-term vaults; diversified custody and attention to security disclosures are increasingly important for crypto users.
Conclusion
The reported $351.6 million drain from Bitgets wallets is a major exchange-side failure, but current statements suggest users balances are economically covered and cold storage is intact. The incident reinforces that the main systemic risk is centralized infrastructure, not just private keys, and that state-linked actors remain highly active in exploiting those weaknesses. Going forward, how quickly Bitget restores withdrawals and publishes a credible postmortem will shape both its own standing and wider market confidence in centralized custody.
CoinsKid.Com