Bitget's Hot Wallets Take a Hot Bath: $351.6M Drained, Cold Wallets Sip Tea Unbothered 🫖

Bitget confirmed that $351.6 million in digital assets were drained from some of its hot and warm wallets after unauthorized transfers were detected at 18:31 UTC on September 24, 2026. CEO Gracy Chen said the company's security team activated emergency response protocols immediately, and that the exchange's three-tier wallet architecture kept cold wallets "fully secure" throughout the incident. "User funds are safe. The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million," Chen posted on X, adding that withdrawals have been temporarily paused while a security review is completed and that a full incident report will be released within 24 hours.

On-chain researchers, including Emmett Gallic of Arkham Intelligence and analysts at Bubblemaps, first flagged the unusual wallet activity on Thursday after approximately $183 million moved from addresses labeled as belonging to Bitget into a newly created wallet. Gallic said three hot wallets and one cold wallet were involved across multiple blockchains, with funds consolidating at address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. Within minutes of the initial outflow, a fresh address beginning in "0xe410" took $19.67 million worth of USDT0 — a cross-chain version of the dollar-pegged stablecoin Tether — and swapped it for 7,111 ETH in roughly six minutes via UniswapX and 1inch Fusion, paying up to 5% above market rates. Chen later clarified that private keys were not stolen and that attackers had breached a backend wallet system, forged transfer details, and triggered Bitget's normal signing process so the transactions appeared authorized.

Stolen assets included ETH, BNB, AVAX, USDC, USDT, USDT0, the tokenized gold token XAUt, and roughly 102.93 million XRP valued at nearly $157.5 million, according to Lookonchain, making XRP the largest single asset taken in the exploit. Chen and on-chain analysts have pointed to North Korea's Lazarus Group as a suspected attacker, though the company has said it will not speculate on the attack vector until the investigation is complete. Bitget stated that law enforcement and external security firms have been engaged and that the affected addresses have been identified and marked.

The incident places Bitget's $351.6 million loss among the largest exchange breaches of 2026, coming roughly three weeks after the Liquid Network lost $320 million in a separate exploit. Bitget's native token, BGB, fell sharply as news circulated but had partially recovered by 22:10 UTC, trading down 2.9% on the day. $BTC was down 0.29% and $ETH was down 0.2% over the prior 24 hours. Deposits and trading remain open on the platform while the withdrawal suspension continues.