Bitget's $351.6M Hot Wallet Heist: Forged Slips, Not Stolen Keys 🚨

Cryptocurrency exchange Bitget confirmed Thursday that approximately $351.6 million was drained from portions of its hot and warm wallet infrastructure in a security breach detected at 18:31 UTC on September 24, 2026. CEO Gracy Chen said the company's cold wallets remain "fully secure" and that "user funds are safe," with the entire loss covered by Bitget's User Protection Fund, which holds more than $464 million. Deposits and trading continue to operate, while withdrawals are temporarily suspended pending a security review, with a comprehensive incident report expected within 24 hours.

Chen said attackers compromised a critical backend system within Bitget's wallet infrastructure, used it to spoof transaction data, and triggered the exchange's authorization process to move funds out. "Private key compromise has been ruled out," she wrote on X, adding that "loss containment is confirmed" and that no further unauthorized transfers are possible. She said the exchange would not speculate on the attack vector until the investigation is complete.

On-chain researchers, including Emmett Gallic of Arkham Intelligence and Bubblemaps, first flagged unusual wallet activity roughly an hour before the official confirmation. Three hot wallets and one cold wallet across multiple blockchains sent funds that consolidated into address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. A newly created wallet beginning with "0xe410" received $19.67 million in USDT0 from a Bitget hot wallet and used UniswapX and 1inch Fusion to purchase 7,111 ETH in about six minutes, paying premiums of up to 5% above market. Stolen assets identified by analysts include ETH, BNB, AVAX, USDC, USDT, USDT0, and XAUt.

On-chain analytics platform Lookonchain reported that 102.9 million XRP, valued at nearly $158 million, was the single largest stolen asset in the incident. Chen said during a live Q&A on X that security investigators had identified IP addresses matching VPN choices associated with a North Korean hacking group, though she said the exchange did not believe the breach was an inside job. On-chain researcher Specter separately alleged a link between the stolen XRP and TraderTraitor, a North Korea-linked group, after tracing funds to an Ethereum address that previously sent ETH to an address labeled "AFX EXPLOITER," a label tied to the $24 million AFX hack in July. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack, which the FBI attributed to North Korea. Chen said some stolen funds had been recovered, without specifying an amount, and that Bitget is coordinating with blockchain foundations and law enforcement on recovery efforts.

Market reaction to the news was muted. Bitget's native token, BGB, was down 2.9% as of 22:10 UTC before partially recovering. Bitcoin's price was down approximately 0.29% over the past 24 hours, while ether's price was down 0.2%. Bitget, officially registered and headquartered in Seychelles, is one of the top 10 cryptocurrency exchanges in the world by trading volume, serving over 125 million users globally.