TLDR
Crypto exchange Bitget has confirmed a large-scale hack that initially drained about $351.6 million from its wallets, later revised to roughly $387.5 million.
- Bitget says attackers compromised a backend wallet system, spoofing transfers from hot and warm wallets while cold storage and private keys stayed secure.
- The loss is covered by Bitgets $464 million User Protection Fund, with trading and deposits still live but withdrawals paused pending a security review.
- Investigators are probing possible North Korea-linked actors, while Bitget launches bounties and the broader crypto market remains largely stable despite the breach.
Deep Dive
1. What Happened At Bitget
Bitget reports that on 24 Sep it detected unauthorized transfers at 18:31 UTC affecting around $351.6 million in assets, later refined to $387.5 million after including Zcash and TRON balances in on-chain tracing, as detailed in its updated incident report and coverage by outlets such as Cointelegraph.
CEO Gracy Chen and multiple reports from CoinDesk state the attacker breached a critical backend system, spoofed transaction data, and triggered Bitgets own authorization process, rather than stealing private keys. The damage was confined to hot and warm wallets, with offline cold wallets described as untouched and fully secure.
The stolen assets span several networks and tokens, including ETH, XRP, USDT, USDC, AVAX, BNB, TRX and ZEC, with analytics firms tracking rapid swaps into large ETH positions that are harder to freeze.
2. Impact On Users And Market
Bitget has paused withdrawals but kept deposits and trading open, while asserting that all affected balances are fully covered by its User Protection Fund holding more than $464 million, according to multiple breach summaries. That means individual customer account entries should remain intact even though users cannot currently move funds off the platform.
At the market level, total crypto market cap sits near 2.88 trillion dollars with only a small 24-hour change and Bitcoin dominance around 58 percent, indicating this hack is large for one venue but not causing a broad systemic selloff. Confidence impact is mostly concentrated in perceptions of centralized exchange security and in flows specifically linked to Bitget.
For most traders, this is a localized exchange risk event rather than a market-wide shock, but it reinforces that custody risk on centralized platforms remains significant.
3. What To Watch Next
Bitget has launched a bounty program, offering a percentage of any frozen or recovered funds through collaboration with other exchanges and security firms, as described in its post-breach update. Recovery progress, plus any frozen attacker wallets, will determine how deeply the protection fund is tapped and how quickly withdrawals can resume.
Investigators, including Mandiant and SlowMist, are exploring patterns consistent with North Korea-linked groups such as Lazarus, but attribution remains very likely rather than fully confirmed in statements cited by CNBC. Users should watch for Bitgets promised technical report, its withdrawal timeline, and any regulatory commentary on centralized exchange controls.
If you use centralized venues, monitor official security notices, proof-of-reserves and incident responses, and consider how much custodial exposure you are comfortable with relative to self-custody risk.
Conclusion
A major backend compromise at Bitget has drained hundreds of millions of dollars from its operational wallets, yet customer balances are expected to be made whole via a large protection fund. The broader crypto market remains relatively calm, so the main lesson is not immediate price risk but the ongoing trade-off between centralized convenience and custody vulnerability, plus the growing sophistication of state-linked hacking groups that target exchange infrastructure.
CoinsKid.Com