Major exchange breach steals $387M from wallets

TLDR

A major breach at exchange Bitget drained about $387 million from its hot and warm wallets, but the company says customer balances are safe and losses will be covered.

1. The attack used stolen internal credentials from a third-party security product to forge withdrawals across multiple chains, ultimately stealing around $387.5 million in crypto.
2. Bitget reports cold wallets and user balances were not touched and plans to cover losses from its protection fund while gradually reopening withdrawals.
3. The incident highlights structural risks of centralized custody and limits of freezing stolen assets, reinforcing the case for careful exchange selection and diversified custody.

Deep Dive

1. How The Breach Worked

Bitget raised its loss estimate to about $387.5 million after a wallet breach that hit hot and warm wallets across at least eight networks, including Ethereum, XRP Ledger, Tron, Zcash, BNB and Avalanche. Multiple reports say the attacker exploited a vulnerability in a third-party security product used in Bitgets wallet backend, stole high-level credentials, and used them to send fake withdrawal commands that passed normal approval checks as if they were legitimate user withdrawals.

Blockchain reconstructions show abnormal activity detected around 18:31 UTC, followed by two rapid waves that moved roughly $290 million in less than 30 seconds, and further transfers until about 21:23 UTC, making this one of 2026s largest exchange hacks. Bitget and external investigators have suggested possible links to North Korea aligned laundering groups, but that attribution remains investigative, not yet court-proven.

2. User Funds And Exchange Response

Bitget states that cold wallets, private keys and user account balances were not compromised, and that the entire loss fits within its User Protection Fund, reportedly over $464 million before the incident. The exchange temporarily halted withdrawals after detecting the breach, then announced a phased reopening: Bitcoin network withdrawals first, followed by Ethereum and USDT on major networks, with other assets and fiat/P2P expected to follow over several days.

Stablecoin issuers have frozen only a small slice of the stolen funds so far, while large amounts in native assets such as ETH and XRP remain movable because those networks do not allow issuers or validators to blacklist individual assets at the protocol level.

3. Lessons For Crypto Users

This breach shows how even without private-key theft, weaknesses in surrounding infrastructure and third-party security tools can still lead to systemic exchange losses via forged but seemingly valid withdrawals. It also illustrates the limits of freezing stolen assets: stablecoins and some wrapped tokens can be blacklisted, but native coins on public chains generally cannot, so much of the haul remains liquid.

For individual users, practical takeaways include treating centralized exchanges as credit and operational counterparties rather than vaults, watching how transparently they disclose post-incident details, and spreading risk across multiple venues and self-custody where appropriate.

Conclusion

The Bitget breach is a reminder that the main failure points in crypto often sit in the infrastructure around wallets and withdrawals rather than in blockchains themselves. While Bitgets protection fund and staged reopening of withdrawals may limit direct user losses, the episode underlines ongoing counterparty risk in centralized custody and the importance of both robust operational security at exchanges and diversified custody strategies for users.