Bitget hot wallet hack: estimates range from $351.6M to $387.5M, North Korea suspected

Suspected North Korea-linked attackers drained Bitget's hot and warm wallets of $351.6M (later revised by some reports to $387.5M) via a backend compromise; cold storage, customer balances, and the self-custodial Bitget Wallet were unaffected.

Cryptocurrency exchange Bitget, based in Singapore, said it detected unauthorized transfers at 18:31 UTC on September 24, 2026, from a limited set of hot and warm wallets. Most outlets reported losses of about $351.6 million (TechCrunch said 'more than $351 million'), but The Record and The Register reported about $387.5 million; The Register said Bitget revised its initial $351.6 million figure after later-identified Zcash and TRON losses. Arkham reported roughly $350 million taken, including about $228 million moved in 18 minutes, with a breakdown of $153 million in XRP, $66.2 million in ETH, $34.8 million in USDT, $12.9 million in USDC, and $12.8 million in Tether Gold. Bitget assets named across reports include ETH, XRP, BNB, AVAX, USDT, and USDC on Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. According to later accounts, attackers compromised a critical backend wallet system, spoofed transaction data, and triggered or bypassed authorization signing so funds moved without private keys being stolen; SecurityWeek notes the initial entry point remains unknown, and early reports had not disclosed the access path. Cold wallets, customer balances, and the separately hosted self-custodial Bitget Wallet were unaffected. Withdrawals were suspended while deposits and trading continued, law enforcement was notified, and Bitget said its User Protection Fund—more than $464 million, or about 5,500 BTC—covers the loss. CEO Gracy Chen and multiple outlets linked IP behavior and on-chain patterns to known North Korean hacker methods, with some reports and analysts citing Lazarus Group resemblance, but attribution remains unconfirmed. Mandiant and SlowMist are investigating, some blockchain foundations and platforms have frozen suspected hacker addresses, and Bitget is offering a 5% bounty on the stolen amount for freezing or recovering attacker funds. Chen promised a full incident report within 24 hours. TechCrunch called it the largest known digital-currency heist of 2026, exceeding a $340 million September hack, and cited TRM Labs attributing about three-quarters of 2026 crypto thefts to North Korea.

• Unauthorized transfers detected at 18:31 UTC on September 24, 2026, from Bitget hot and warm wallets.
• Loss estimates conflict: about $351.6 million in most reports versus about $387.5 million in The Record and The Register; The Register says Bitget revised upward from $351.6 million after adding Zcash and TRON losses.
• Arkham reported roughly $350 million stolen, including about $228 million moved in 18 minutes: $153M XRP, $66.2M ETH, $34.8M USDT, $12.9M USDC, and $12.8M Tether Gold.
• Assets named across reports: ETH, XRP, BNB, AVAX, USDT, USDC, plus later-identified Zcash and TRON, on Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base.
• Attack method: compromise of a backend wallet system that spoofed transaction data and triggered or bypassed authorization signing; private-key leakage was ruled out, and the initial entry point remains unknown per SecurityWeek.
• Cold wallets, customer balances, and the separate self-custodial Bitget Wallet were unaffected; withdrawals were suspended while deposits and trading continued.
• Bitget says a User Protection Fund of more than $464 million (about 5,500 BTC) covers the loss.
• CEO Gracy Chen cited IP behavior and on-chain patterns consistent with North Korean hackers; some reports and analysts noted Lazarus Group resemblance, but attribution is unconfirmed.