Hackers broke into Bitget's backend systems on September 24, 2026, and moved about $351.6 million out of the exchange's hot and warm wallets. Some of those funds have since been frozen or rec
Hackers broke into Bitget's backend systems on September 24, 2026, and moved about $351.6 million out of the exchange's hot and warm wallets. Some of those funds have since been frozen or recovered, though Bitget has not said how much.
The exchange has paused withdrawals while it investigates, but users can still deposit and trade.
CEO Gracy Chen says cold storage was not touched and that Bitget's User Protection Fund, worth over $464 million, covers the full loss. It is the largest breach of a centralized exchange so far this year.
The on-chain record gives a more detailed picture than Bitget's first notice.
Bitget says its systems detected unauthorized transfers at 18:31 UTC on Sept. 24. Blockchain data shows the first movement in that same minute:
A second wallet, "Bitget 35," added 15,362 ether in three transfers. Exchanges run hot wallets on many networks, and shutting each one down safely is not a single switch. Still, the gap between detection and containment was measured in hours.
Bitget says the losses were spread across seven chains: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base. Per reports, stolen assets also includes 20.59 million TRX. Blockchain tracker Lookonchain estimates XRP was the largest single asset taken, at 102.93 million tokens worth $157.48 million. Across Ethereum and Arbitrum alone, $133.4 million left Bitget wallets, plus 3,000 Tether Gold (XAUt) tokens worth $12.8 million.
Bitget uses three wallet tiers: online hot wallets for instant transactions, warm wallets that refill them, and offline cold wallets. Only parts of the first two were breached.
Bitget has not named the exact entry point, but it has ruled out a key leak. In a live Q&A, Chen said private keys for all three tiers were not exposed. Instead, attackers got into Bitget's systems and moved funds directly, without using customer withdrawal requests.
In simple terms, attackers got into the backend system that prepares transfers and fed it forged requests. Bitget's own approval process then signed them as normal payouts. The keys stayed safe, but the controls in front of them failed.
Chen said the attack is highly consistent with known patterns of North Korean hacker groups, based on IP behavior and on-chain analysis. Ido Sofer, CEO of key management firm Sodot, has described this pattern as "off-chain hacks that led to on-chain loss of funds," where stolen credentials and API keys give attackers access to move money.
The attacker's choice of assets shows a plan. Tether can freeze USDT and XAUt, and Circle can freeze USDC. No one can freeze ether.
Within six minutes, the attacker pushed the stablecoins through a router contract into Uniswap V3 and V4 pools and swapped them for ether. Pseudonymous analyst DCF GOD noted the buyer was paying up to 5% over spot, which only makes sense if the seller is racing a freeze.
Bitget says some chain foundations have frozen hacker addresses, and Chen said some stolen funds have been recovered, without giving an amount. As of early Friday, roughly 24,590 ether sat in three attacker wallets.
Bitget says yes, and points to three buffers:
Withdrawals remain frozen with no reopening date, and Chen said Bitget "will not commit to a window we cannot guarantee." The on-chain trading service was also temporarily unavailable on Friday. Bitget has hired an outside security team for an independent forensic review, and its full incident report is due by about 21:30 UTC on September 25.
Bitget Wallet, the separate self-custody app, was not affected. European users are hit hardest, since Bitget has been leaving the EEA under MiCA rules and had told remaining customers to withdraw.
Bitget's exchange token held up better than expected. BGB traded around $1.97 early in Friday's Asian session, roughly 3% to 5% below Thursday's $2.02 to $2.06 range.
Within hours, scammers began sending fake tokens named "ETH," "USDC," and "USDT" from lookalike addresses that differ from the real ones only in the middle. This is called address poisoning. By 22:00 UTC, 14 had appeared against one attacker wallet. Anyone copying addresses from a block explorer should check every character.
Attackers moved $351.6 million out of Bitget after pushing forged transfers through its own backend systems. Private keys and cold wallets were not compromised, the outflow has stopped, some funds have been frozen or recovered, and a 5,500 BTC protection fund covers the loss. Withdrawals stay frozen until the security review is complete.
