Introduction
Bitget confirmed on September 24 that attackers drained approximately $351.6 million from its hot and warm wallets, marking the largest crypto exchange theft of 2026 so far. The Seychelles-based exchange detected unauthorized transfers at 18:31 UTC and immediately suspended withdrawals while launching an emergency security review.
How the Attack Worked
Spoofed Transfers, Not Stolen Keys
The attackers did not steal private keys. Instead, they compromised a backend system within Bitget's wallet infrastructure, spoofed transaction data, and triggered the exchange's own authorization process to approve the transfers. CEO Gracy Chen compared the method to slipping forged withdrawal slips through a bank's teller window, where the vault keys never left the building but the paperwork looked official enough to pass approval. This distinction matters because private key compromises have driven some of the industry's most devastating losses, and Bitget's situation points to a different class of vulnerability.
Which Assets Were Stolen
The stolen funds spanned multiple blockchains, including Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base. XRP accounted for the single largest loss at approximately $158 million, with roughly 102.9 million tokens moved out. The stolen ETH and XRP were quickly split among new wallets, many holding round amounts of about 10,000 ETH or 20 million XRP, and most of those funds had not moved again by the following morning.
Financial Fallout and Recovery
H3: User Protection Fund Coverage
Bitget says the full loss falls within its User Protection Fund, which currently holds over $464 million, backed by 5,500 BTC in publicly verifiable wallets. The exchange maintains that cold wallets were unaffected and user funds remain safe, while deposits and trading continue normally.
North Korea Connection and 2026 Hack Rankings
Chen has described North Korean involvement as very likely, and on-chain analysts at TRM Labs found links to previously identified North Korean thefts, including the Bybit and AFX Bridge exploits. North Korea is suspected of being behind roughly three-quarters of all crypto theft in 2026 so far, and the Bitget breach pushes suspected North Korean crypto heists past $1 billion this year alone. Before Bitget, the largest 2026 exploit was the Liquid Network hack at approximately $319 million.
Conclusion
The Bitget breach highlights a shift in attack strategy away from stealing private keys and toward manipulating the systems that authorize transactions. That approach leaves fewer traces for traditional security audits to catch, because the signatures and keys involved are legitimate. With exchanges holding billions in hot wallets and North Korean-linked groups increasingly targeting approval systems rather than vaults, the industry faces a gap between how funds are protected at rest and how they are verified in motion.
Disclaimer:
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are highly volatile, and readers should conduct their own research before making any financial decisions.
