Bitget Hack: What the $387.5M Breach Means for You

Quick answer: On September 24, 2026, at 18:31 UTC, Bitget detected unauthorized transfers out of its hot and warm wallets. The exchange first put the damage at $351.6 million, then revised it to roughly $387.5 million after tracing extra Zcash and TRON transfers. Bitget says cold storage wasn’t touched, customer balances are unaffected, and its User Protection Fund (reported at more than $464 million) covers the loss. It suspects North Korean actors. Withdrawals came back in stages from September 28, with everything due by October 2. If you keep coins on Bitget, the near-term risk looks contained. The bigger lesson is about how much any exchange’s security depends on backend systems you can’t see.

Editor’s Update: September 30, 2026. Bitget’s phased restart has so far followed its published schedule: Bitcoin withdrawals reopened September 28 and Ethereum on September 29 (both at 08:00 UTC), with USDT due today, September 30, and all remaining assets by October 2. On the recovery side, one outlet, Tech Times, reports that only about $503,000 has been frozen so far and that the stolen funds are “almost certainly gone.” We couldn’t confirm that figure with a second source, so treat it as provisional. The loss figure of about $387.5 million has not changed.

What Happened on September 24

Bitget CEO Gracy Chen disclosed the incident after blockchain researchers had already spotted roughly $183 million in suspicious wallet movements. The exchange suspended withdrawals but kept deposits and trading online, and promised an incident report within 24 hours.

The preliminary explanation is short and a little chilling. Per Bitget, the attacker “compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.” In plain English: nobody appears to have cracked a private key. Someone got into the machinery that decides which withdrawals look legitimate, and fed it convincing fakes.

One outlet, Bitcoin.com News, reports the entry point was a vulnerability in a third-party security product that yielded high-level internal credentials. That detail comes from a single source so far, and Bitget hasn’t published its full forensic report, so treat it as unconfirmed. Mandiant and SlowMist are helping with the investigation.

Why the Number Changed

The headline figure moved by about $36 million in a few days. That’s normal in the first 72 hours of a hack, but it trips people up, so here’s the trail:

• $351.6 million: the first figure, reported by CoinDesk, Insurance Journal and The Hacker News on September 24-25.
• $387.5 million: the revised figure after Bitget traced additional Zcash and TRON transfers, carried by Yahoo Finance, CryptoTimes and The Hacker News’ weekly recap (“over $387 million”).
• About $390 million: the running total The Hacker News later cited for funds moved to attacker addresses across multiple networks.

We’ll use $387.5 million as the working number. It may move again.

Which Assets Were Taken, and Where They Went

The theft wasn’t one coin on one chain. Reports list ETH, XRP, BNB, AVAX, ZEC, TRX, USDT and USDC, spread across Ethereum and other EVM networks, the XRP Ledger, Zcash and TRON. That spread matters, because each chain offers a different chance of clawing money back.

Stablecoins were the easy part. Circle and Tether froze a small slice of USDC and USDT tied to the hack, which crypto.news puts at about $318,000 by September 26 (roughly 99,990 USDC and 218,023 USDT). Other outlets round slightly higher. That’s a rounding error against $387.5 million, but it proves the mechanism works.

Native XRP is the opposite case. CoinDesk reported that around 103 million XRP, worth about $160 million at the time, was spread across five accounts, and that by Saturday, September 26, the attacker had already moved about $83 million of it. The XRP Ledger lets issuers freeze tokens they create, but that power doesn’t extend to XRP itself. Not even Ripple can block those coins from being spent. Some coverage cites $157 million in unfreezable XRP; the exact dollar figure shifts with price, so read it as “roughly $150-160 million.” (We’ll leave the deeper XRP angle to our XRP coverage.)

Then there’s THORChain. According to a Bitget update relayed by CoinGabbar, about 101.5 BTC and 27.63 million XRP passed through the cross-chain protocol. Chen asked THORChain to halt service to the attacker addresses, arguing that “decentralization is a design principle and not a shield for moving known stolen funds.” THORChain reportedly declined, pointing to its permissionless design. Same report: September swap volume hit $1.72 billion. Laundering routes are busy.

The North Korea Angle

Bitget suspects North Korean actors, and the on-chain analysis cited by The Hacker News found connections between the stolen funds and addresses used to launder earlier DPRK-attributed exploits. The pattern is consistent with the TraderTraitor group. Bloomberg reported on September 25 that the Bitget theft pushed suspected North Korean crypto theft past $1 billion for 2026; The Hacker News put the running total at $1.04 billion.

A caution, though. “Suspected” is doing real work in that sentence. Bitget has not published forensic proof of attribution, and no government has formally confirmed it. Past attributions have often been confirmed weeks later by the FBI or private analysts, but some have shifted. Until then, it’s a credible working theory, not a verdict.

What Bitget Says It’s Doing

The response has been fast by industry standards.

• Protection fund: Bitget says the loss falls fully inside its User Protection Fund, reported at over $464 million, with a 127% reserve ratio cited by Bitcoin.com.
• Phased withdrawals: Bitcoin restarted September 28 at 08:00 UTC, Ethereum on September 29, USDT on September 30, and everything else, including P2P and fiat services, by October 2.
• Bounty: 5% of frozen funds and 5% of recovered assets for information that leads to recovery.
• Vulnerability: The Hacker News reports it was identified and addressed by September 26.

Bitcoin.com News reported that roughly 9,585 BTC withdrawal transactions, about 4,098 BTC, were processed in the first hour of the restart. That’s a useful sign that the queue wasn’t a bank run in slow motion, though one hour of data isn’t a trend.

What’s Still Unknown

Quite a lot. Bitget hasn’t released its full security report. The attacker’s identity is unconfirmed. Total frozen assets are unclear, and so is whether each withdrawal phase lands on schedule. Reports also differ on smaller items, like a plan to top the protection fund back up, that we couldn’t verify across multiple sources, so we’ve left them out.

Founded in 2018 and registered in the Seychelles, Bitget claims about 120 million registered users. CertiK’s Esme Pau called the incident “one of the most substantive centralized exchange exploits of 2026.” Its native BGB token slid about 2.9% on the disclosure, a fairly mild reaction, which tells you how much the market believed the protection-fund promise.

A Realistic Scenario: You Wake Up to a Frozen Withdrawal Button

Picture it. You check your phone Friday morning, see the news, and open your exchange app. Your balance looks the same. Trading works. The withdraw button says “paused.”

What do you actually do? Not much, and that’s the point. Your balance is a database entry, and the question is whether the exchange can honor it. Here, Bitget says yes, and its reserve claims are large relative to the loss. Panic-selling into a dip on an exchange you can’t withdraw from just locks in a price you didn’t choose. A calmer checklist: read the official incident updates (not reposts), confirm any restart dates on Bitget’s own channels, and ignore every DM offering “recovery help.” Hack aftermaths are prime time for scams, which we cover in our guide on how to spot a crypto scam before it costs you.

What This Means for Anyone Holding Crypto on an Exchange

Three takeaways, none of them dramatic.

Hot wallets are the soft target. Exchanges keep a working float online so withdrawals process quickly. Bitget’s three-tier setup (hot, warm, cold) did what it was designed to do, since cold storage survived. But the same design meant attackers only needed to fool the systems around the hot layer, not steal keys.

Reserve claims are only as good as their proof. A protection fund is reassuring. It isn’t an audit. The BitMEX shutdown taught a similar lesson about reading solvency claims carefully; our piece on why BitMEX shut down covers how proof-of-reserves language works in practice.

2026 has been a rough year for infrastructure. We’ve tracked the $320 million Liquid Network incident, the SingularityNET bridge hack, and record DeFi price-manipulation exploits. Different mechanics, same theme: the weak point is usually the plumbing around the cryptography, not the cryptography itself.

If your holdings are more than you’d shrug off losing, the cleanest answer is old advice: keep only what you’re actively trading on an exchange, and move long-term holdings to self-custody you understand. That comes with its own risks, since lose the seed phrase and no protection fund helps you. Pick your trade-off deliberately.

Frequently Asked Questions

How much was stolen in the Bitget hack?

Bitget first reported $351.6 million on September 24, 2026, then revised the total to about $387.5 million after tracing additional Zcash and TRON transfers. Some outlets cite roughly $390 million moved to attacker addresses. Figures may change as the investigation continues.

Are my funds on Bitget safe?

Bitget says cold wallets were unaffected, customer balances are unchanged, and its User Protection Fund (reported at over $464 million) covers the loss. Those are the exchange’s own claims and have not been independently audited in full. Withdrawals are being restored in phases through October 2.

Who is behind the Bitget hack?

Bitget suspects North Korean actors, and on-chain analysis links the stolen funds to addresses used to launder earlier DPRK-attributed thefts. No government or forensic firm has formally confirmed attribution yet.

How did the attackers get in?

Bitget says they compromised a backend system in its wallet infrastructure and spoofed transaction data to trigger authorization. One report points to a third-party security product vulnerability, but that isn’t confirmed. Private keys and cold wallets weren’t reported compromised.

Can the stolen crypto be recovered?

Partly, at best. Circle and Tether froze a small amount of stablecoins, but native XRP on the XRP Ledger can’t be frozen, and THORChain reportedly declined to block attacker addresses. Bitget has offered a 5% bounty on frozen and recovered funds.

When do Bitget withdrawals fully resume?

Bitcoin restarted September 28, Ethereum was scheduled for September 29, USDT for September 30, and all remaining assets plus P2P and fiat services by October 2, subject to the exchange keeping to schedule.

Key Takeaways

• Bitget lost roughly $387.5 million (first reported as $351.6 million) from hot and warm wallets on September 24, 2026.
• The attacker allegedly spoofed transaction data through a compromised backend system; no private-key theft has been reported.
• Bitget says cold storage and customer balances are unaffected and that its $464 million-plus protection fund covers the loss.
• Attribution to North Korea is suspected, not confirmed; 2026 thefts tied to DPRK are reported above $1 billion.
• Stablecoins can be frozen; native XRP can’t, and THORChain reportedly refused to block attacker addresses.
• Withdrawals are returning in stages through October 2. Use official channels only and ignore “recovery” DMs.
• Update, September 30: Ethereum withdrawals reopened on schedule September 29; one outlet reports only about $503,000 frozen so far (unconfirmed by a second source).

Sources

• CoinDesk: Bitget loses $352 million in hack (Sept 24, 2026)
• Insurance Journal: Crypto Exchange Bitget Says Hackers Stole $352 Million (Sept 25, 2026)
• The Hacker News: Bitget Says Suspected North Korean Hackers Stole $351.6M
• The Hacker News: Weekly Recap, $387M Crypto Hack
• Yahoo Finance: Bitget to resume withdrawals after $387.5m hack
• CryptoTimes: Bitget withdrawal schedule (Sept 26, 2026)
• Bitcoin.com News: Bitget restarts Bitcoin withdrawals
• CoinDesk: Bitget hacker moves $83 million in stolen XRP (Sept 26, 2026)
• CoinGabbar: Bitget hack update, THORChain
• Bloomberg: Bitget hack pushes North Korean crypto haul past $1 billion (headline, Sept 25, 2026)

Want to keep tabs on how exchange and protocol security stories develop? Browse our Blockchain News section, where we follow each incident from first headline to final post-mortem.

This article is for information only and is not financial advice. Crypto assets are volatile and exchanges carry counterparty risk. Do your own research (DYOR) before making any decisions.