Major Exchange hack losses reach $387.5M

TLDR

Bitget, a large global crypto exchange, now pegs losses from its Sept. 24 wallet breach at about $387.5 million, one of the biggest exchange hacks in 2026.

1. Bitget says around $387.5 million in XRP, ETH, stablecoins and other assets moved from hot and warm wallets to attacker-controlled addresses, while cold storage and trading remained intact.
2. The exchange plans phased withdrawal restarts and claims its user protection fund, holding over $464 million, will fully cover the loss for customers.
3. The hack feeds a wider debate on how decentralized protocols handle stolen funds and highlights that most 2026 crypto losses stem from infrastructure, not just smart-contract bugs.

Deep Dive

1. What Happened At Bitget

Bitget reports that unauthorized transfers began on Sept. 24 at 18:31 UTC, initially estimated at $351.6 million, then revised to about $387.5 million after adding Zcash and TRON positions to the tally. The breach hit hot and warm wallets across EVM chains, XRP Ledger, Zcash and TRON, affecting assets such as XRP, Ether (ETH), Tether (USDT), USD Coin (USDC), BNB, Avalanche (AVAX) and TRX, while cold wallets stayed secure according to Bitgets incident update from TokenPost and Crypto.news.

Investigations suggest a backend wallet service compromise that spoofed transaction data, making internal transfers appear legitimate while routing funds to attacker addresses, rather than a direct private-key or cold-storage theft, as described by Cryptobriefing on TradingView.

2. User Impact And Exchange Response

Bitget suspended withdrawals but left deposits and trading live, stating that customer balances remained accurate and that the underlying vulnerability had been identified and fixed in its incident notices. The exchange says a dedicated user protection fund, holding more than $464 million including 5,500 BTC, is sufficient to cover the $387.5 million loss, with BTC withdrawals reopening Sept. 28 and other assets in stages through Oct. 2, per Crypto.news and Yahoo Finance.

For institutions, Swiss bank Sygnum has promoted off-exchange collateral accounts that are bankruptcy-remote under Swiss law, offering an additional layer of protection, although Bitget-specific usage and payout mechanics remain undisclosed in reporting by CryptoSlate.

3. Broader Security And Decentralization Lessons

Reports show the attacker is now laundering funds through other venues, including Binance withdrawals and multiple DeFi protocols such as THORChain, Uniswap and Chainflip, with tens of millions of dollars swapped into BTC, as detailed by Bitcoin.com and Cryptobriefing. Bitgets CEO has publicly urged THORChain to block known hacker addresses, prompting pushback that permissionless networks should act as neutral infrastructure rather than active censors.

Zooming out, an industry review cited by Coinpedia tallies about $2.21 billion lost to 288 crypto incidents in 2026, noting that a small number of mega-breaches like Bitget dominate totals and that infrastructure or operational compromises account for most of the dollars stolen.

Conclusion

Bitgets $387.5 million hack underscores that even large, solvent exchanges remain exposed when hot-wallet and backend controls are compromised. Protection funds and institutional custody structures can limit user losses, but they do not remove infrastructure risk. The next few days of withdrawal reopening, fund coverage and on-chain tracking of the attackers wallets will show whether Bitgets response can contain reputational damage and inform stronger security and governance standards across both centralized exchanges and DeFi.