Bitget's hot wallets had a really cold day: $388M drained, North Korea probably RSVP'd 🧊

Crypto exchange Bitget confirmed that approximately $387.5 million in digital assets were transferred to attacker-controlled addresses during a security breach on September 24, 2026, revising an earlier estimate of $351.6 million. Bitget said the increased figure reflects a more complete accounting of transfers that occurred during the incident, including affected assets on Zcash and TRON that were not part of the initial estimate, and emphasized that no further unauthorized transfers had taken place.

Bitget's security systems first detected unauthorized transfers from several hot wallets at 18:31 UTC on September 24, CEO Gracy Chen said, after which the exchange activated its emergency response protocols. In an X post and subsequent live Q&A, Chen said the attackers compromised a critical backend system within the exchange's wallet infrastructure, used it to spoof transaction data, and triggered the authorization process to move funds out. "Private key compromise has been ruled out," Chen wrote, adding that loss containment was confirmed and that a full technical report would follow once the investigation is complete.

On-chain researchers including Bubblemaps and Arkham analyst Emmett Gallic first flagged the unusual wallet activity, initially reporting that roughly $183 million had moved from wallets labeled as belonging to Bitget. Within minutes, a newly created address beginning with "0xe410" took $19.67 million worth of USDT0 — a cross-chain version of the dollar-pegged stablecoin Tether — and used decentralized trading services UniswapX and 1inch Fusion to purchase 7,111 ETH in about six minutes, paying up to roughly 5% above market rates. The stolen assets spanned Ethereum Virtual Machine networks, the XRP Ledger, Zcash and TRON, and included XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX. On-chain analytics platform Lookonchain reported almost 102.9 million XRP stolen, valued at nearly $157.5 million, making XRP the largest single stolen asset.

In her live Q&A, Chen said preliminary findings pointed to North Korean involvement. "We've identified some IP addresses that match the VPN choices by a certain DPRK group," Chen said, referring to the Democratic People's Republic of Korea, while noting the exchange did not believe the breach was an inside job. On-chain researcher Specter independently alleged a link between the Bitget theft and a North Korean hacking collective, tracing some of the stolen XRP to an Ethereum address that had received 68,808 USDT from a wallet previously connected to an address labeled "AFX EXPLOITER," with AFX having suspected involvement by TraderTraitor, a North Korea-linked group, in its postmortem for a separate $24 million July hack. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack that the FBI attributed to North Korea.

Bitget said cold wallets remain fully secure, account balances are accurate and user funds are protected, with deposits and trading continuing to operate normally. The exchange temporarily suspended withdrawals pending a security review, announced that updates would be shared hourly and launched a bounty program to incentivize freezing or recovering the stolen assets. Bitget's User Protection Fund, which holds more than $464 million, will cover the reported loss. Chen said during the Q&A that some stolen funds had been recovered without specifying an amount and that the exchange was working with blockchain foundations and other partners on recovery efforts. Bitget, officially registered and headquartered in Seychelles, is one of the top 10 cryptocurrency exchanges in the world by trading volume and serves over $125 million users. The exchange's native token, BGB, fell sharply after news of the hack began circulating but had partially recovered by 22:10 UTC, down 2.9%, while $BTC's price was down roughly 0.29% and $ETH's price was down 0.2% over the prior 24 hours.