Hot Wallets, Cold Sweat: Bitget's $351.6M Bad Day Gets Worse 😬

Crypto exchange Bitget confirmed a $351.6 million security breach on September 24, 2026, after unauthorized transfers drained portions of its hot and warm wallet infrastructure, CEO Gracy Chen said in posts on X. The exchange detected the activity at 18:31 UTC and activated its emergency response, temporarily pausing withdrawals while deposits and trading continued. Chen said cold wallets remained fully secure and that user funds are safe, with the full loss covered by Bitget's User Protection Fund, which she said holds more than $464 million. "User funds are safe. The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million," Chen wrote. She added that Bitget operates a three-tier wallet architecture and that the breach was contained to part of the hot and warm wallet layers, promising a full incident report within 24 hours.

On-chain researchers at Arkham Intelligence and Bubblemaps first flagged the unusual movements, with Arkham analyst Emmett Gallic posting that approximately $183 million had moved from Bitget-labeled wallets into a newly created address, 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee, before the total swelled to $351.6 million. According to Lookonchain, 102.93 million $XRP, valued at nearly $157.5 million, was the single largest stolen asset, followed by $ETH, $AVAX, $BNB, $USDC, $USDT, $USDT0, tokenized gold $XAUT, and $TRX. One fresh wallet beginning with "0xe410" took $19.67 million in $USDT0 and swapped it for 7,111 $ETH in roughly six minutes via UniswapX and 1inch Fusion, paying up to 5% above spot prices, a premium consistent with time-sensitive liquidation. Chen said private keys were not stolen and that the attacker breached a backend wallet system, forged transfer details, and triggered Bitget's normal signing process so the outgoing transfers appeared authorized. She and on-chain analysts suspect North Korea's Lazarus Group is behind the exploit.

The incident ranks as potentially the largest centralized exchange hack of 2026, surpassing the $320 million loss reported by the Liquid Network earlier in September, an event in which the attackers claimed to be white-hat hackers. Bitget's native token $BGB dropped sharply following the news before partially recovering, down 2.9% as of 22:10 UTC on September 24, while $BTC fell 0.29% and $ETH fell 0.2% over the prior 24 hours. Bitget said account balances remained accurate throughout the suspension and that the security review was ongoing.