Nineteen months after Bybit’s $1.5 billion hack, another top exchange has lost hundreds of millions from its online wallets. On Thursday, September 24, 2026, Bitget detected unauthorized transfers at 18:31 UTC. CEO Gracy Chen first put the loss at about $351.6 million; after more tracing, Bitget raised it to $387.5 million.
Bitget says no private keys were stolen, its cold wallets are intact and a protection fund will cover users. The details matter more than the headline: how the attackers got in without keys, and why the first public estimates missed roughly half of the damage.
Key facts
- Bitget detected unauthorized transfers from its hot and warm wallets at 18:31 UTC on September 24, 2026.
- CEO Gracy Chen first estimated the loss at about $351.6 million; Bitget later revised the figure to $387.5 million.
- Funds left over seven networks — Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base — with the largest single loss in XRP, about 102.9 million XRP (~$157.5 million) per Lookonchain.
- Attackers broke into a backend wallet system, spoofed transaction data and triggered Bitget’s own approval process; Bitget says private keys were not stolen.
- Chen said IP behavior and on-chain patterns were “highly consistent” with known North Korean hacker groups — Bitget’s own assessment, not an official attribution.
- Bitget says its User Protection Fund of over $464 million, plus more than $1 billion of its own capital, will cover losses; withdrawals were suspended while trading continued.
What happened to Bitget on September 24, 2026?
On September 24, 2026, attackers moved about $387.5 million out of Bitget’s hot and warm wallets across seven blockchains. They did not steal private keys. Instead they compromised a backend wallet system and fed it fake transaction data, so Bitget’s own approval process signed the transfers. Withdrawals were suspended; trading kept running.
As BleepingComputer reports, Bitget says its cold wallets were not touched and that the self-custodial Bitget Wallet runs on separate infrastructure and was not affected. Chen said that “no further unauthorized transfers are possible.” The exchange is working with Mandiant, SlowMist and law enforcement.
The number moved twice in the first hours, which is normal in a hack of this size. Chen’s first estimate was $351.6 million. Further tracing raised it to $387.5 million — and even the first figure was nearly double what some public trackers were showing.
Which coins were stolen from Bitget?
The biggest outflows were XRP, ETH and stablecoins. Blockchain analytics account Lookonchain broke down the largest pieces, according to InvestingLive:
| Asset | Amount | Approx. value |
|---|---|---|
| XRP | ~102.9M XRP | ~$157.5M |
| ETH | 31,890 ETH | ~$85.8M |
| USDT | — | ~$34.8M |
| USDC | — | $21.1M |
| USDT0 | — | $19.7M |
That XRP line explains an odd early discrepancy. Initial trackers, cited by InvestingLive via CoinMarketCap, saw only about $183 million leave Bitget — most likely because they missed the XRP Ledger transfers, where the single largest loss happened. Tooling built around EVM chains sees EVM chains first.
The story kept moving after the first day. Circle and Tether reportedly froze a wallet linked to the attacker on September 25, and on September 26 the hacker reportedly moved about $83 million in XRP out of reach of freeze controls. Those follow-ups come from later reports, not from Bitget’s initial disclosure.
How did hackers drain Bitget without the private keys?
They attacked the process around the keys rather than the keys themselves. According to Bitget, the attackers gained access to a backend wallet system, spoofed the transaction data it handled and triggered the normal approval flow. The exchange’s own signing then approved transfers that looked legitimate but weren’t.
Chen compared the incident to Bybit’s roughly $1.5 billion hack in February 2025. For users, the shared lesson is about hot wallets in general: they are online by design, and every system that can tell them what to sign becomes part of the attack surface. Keeping keys in a vault doesn’t help if the instructions reaching the vault are forged.
The keys can stay safe while the money still leaves.
On attribution, Chen said the IP behavior and on-chain patterns were “highly consistent with known patterns of North Korean hacker organizations.” That is Bitget’s own reading of the evidence, not a law-enforcement finding, and it should be treated as such until investigators say more.
Will Bitget users get their money back?
Bitget says users will be covered. It points to a User Protection Fund of over $464 million — described as 5,500 BTC — plus more than $1 billion of its own capital. Cold wallets were untouched. With withdrawals paused during the investigation, the immediate issue for customers is access to funds rather than whether the exchange can pay.
That is a credible-looking promise, but it is still a promise from the counterparty that just got hacked. A paused withdrawal queue is exactly the moment users learn the difference between a balance and coins. We go through that pattern in 5 reasons CEX risk is real, and it was the theme of the week: a day earlier, BitMEX shut down after 11 years, leaving users with a withdrawal to-do list of their own.
What it means for swap users
An exchange hack hits whoever has a balance on that exchange at that moment. The fewer hours your coins spend in someone else’s hot wallet, the smaller that exposure. SwapZilla works without a balance: no account, no deposit parked in a wallet you don’t control. You compare quotes from several licensed exchange providers, send coins for one swap, and the output goes straight to your own address. SwapZilla never holds the funds — the provider you chose executes the swap. There is still counterparty exposure while a swap is in progress, which is why our provider list is public and the flow is laid out in how it works. For long-term holdings, cold storage beats any hot wallet.
Final thoughts
Bitget’s incident looks contained for now: a revised figure of $387.5 million, a protection fund large enough to cover it, cold wallets intact and an investigation with Mandiant and SlowMist. If the reimbursement promise holds, most customers will end up whole.
Two lessons outlast the headlines. First, a hot wallet can be drained without its keys ever leaving the building — the weak point can be any system that feeds it instructions. Second, early numbers in a hack are lower bounds: $183 million, then $351.6 million, then $387.5 million, all within a day or so.
In a hack, the first number is the floor, not the total.