Bitget's Hot Wallets Got Ghosted for $351.6M — Cold Ones Swiped Right With User Funds Intact 🧊

Crypto exchange Bitget confirmed on Thursday that approximately $351.6 million was drained from portions of its hot and warm wallet infrastructure after unauthorized transfers were detected at 18:31 UTC on September 24, 2026. CEO Gracy Chen said in posts on X that cold wallets "remain fully secure" and that user funds are safe, with the full loss covered by Bitget's User Protection Fund, which currently holds more than $464 million. The exchange has temporarily suspended withdrawals while a security review is conducted, though deposits and trading remain online and account balances are unaffected.

On-chain researchers including Emmett Gallic of Arkham Intelligence, Bubblemaps, DCF GOD, Lookonchain, and Specter were among the first to flag unusual movements from wallets tied to the exchange. Approximately $183 million was initially observed moving to a newly created address, 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee, before the larger total was disclosed. A separate fresh wallet beginning with "0xe410" received $19.67 million in USDT0 and swapped it for 7,111 ETH on Arbitrum in roughly six minutes via UniswapX and 1inch Fusion, paying up to 5% above spot price. Additional stolen assets spanned multiple chains and included ETH, BNB, AVAX, USDC, USDT, TRX, XAUt, and approximately 102.93 million XRP valued at nearly $157.5 million, according to Lookonchain.

Chen said the attackers breached a backend wallet system, forged transfer details, and triggered the exchange's normal signing process so outgoing transactions appeared legitimate. She emphasized that private keys for cold, hot, and warm wallets were not stolen and that user withdrawal requests were not forged. Law enforcement and external security firms have been engaged, marked addresses have been identified, and hourly updates are being issued alongside a full incident report expected within 24 hours.

During a live Q&A on X, Chen said investigators had identified IP addresses matching VPN services used by a North Korean group and that the attack pattern resembled previous operations attributed to that group, while noting the exchange does not believe the breach was an inside job. On-chain researcher Specter separately traced some of the stolen XRP to an Ethereum address that received 68,808 USDT from a wallet previously linked to "AFX EXPLOITER," an address tied to a $24 million July exploit that AFX said suspected involvement from TraderTraitor, a North Korea-linked group. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack attributed to the country by the FBI. Chen added that some stolen funds had been recovered without specifying an amount, and that the exchange is coordinating with blockchain foundations and other partners on recovery efforts.

Bitget's native token BGB fell sharply following news of the breach before partially recovering, ending the session down 2.9% as of 22:10 UTC. $BTC was down 0.29% and $ETH was down 0.2% over the prior 24 hours of trading. The incident comes shortly after the Liquid Network lost $320 million earlier in September in an exploit whose attackers claimed to be "white hat hackers," making the Bitget breach potentially the largest of 2026 by exposure.