Bitget's $387.5M Hot Wallet Heist: Forged Slips, Cold Vault Untouched, Lazarus Lurking 🔓

Cryptocurrency exchange Bitget confirmed that approximately $387.5 million in digital assets were drained from its wallet infrastructure in a security breach detected at 18:31 UTC on September 24, 2026, making it the largest crypto hack of the year. CEO Gracy Chen said in a security notice on X that unauthorized transfers originated from portions of the exchange's hot and warm wallet layers, while cold wallets — kept offline for safekeeping — remained "fully secure." Bitget operates a three-tier wallet architecture, and Chen ruled out a compromise of private keys, stating attackers instead breached a backend system within the wallet infrastructure, used it to spoof transaction data, and triggered the exchange's own authorization process to move funds out. "They did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet," Chen said during a live Q&A on X. Bitget's User Protection Fund, which holds over $464 million, covers the full reported loss, and account balances remain accurate, according to Chen. Deposits and trading continue to operate; withdrawals are temporarily suspended pending a security review, with a full incident report expected within 24 hours of the initial detection.

On-chain investigators flagged unusual wallet movements before Bitget went public. Emmett Gallic, an analyst at Arkham Intelligence, said the transactions involved three Bitget hot wallets and one cold wallet across multiple blockchains, with funds consolidated into a single address, 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. Pseudonymous researcher DCF GOD traced a freshly created address beginning with "0xe410" that spent $19.67 million in USDT0, a cross-chain version of the dollar-pegged stablecoin Tether, to purchase 7,111 ETH in approximately six minutes through UniswapX and 1inch Fusion, paying up to 5% above market price. Other wallets tagged as Bitget's sent ETH, BNB, AVAX, USDC, USDT, XAUt, and XRP to attacker-controlled addresses. On-chain analytics platform Lookonchain reported almost 102.9 million XRP stolen, valued at nearly $157.5 million, making XRP the largest single asset drained. Bitget's revised figure of $387.5 million reflects a more complete accounting of transfers across EVM networks, the XRP Ledger, Zcash and TRON, including affected assets on Zcash and TRON that were not included in the initial $351.6 million estimate.

Chen said preliminary findings link the breach to North Korean hackers, citing IP addresses that match VPN choices used by a Democratic People's Republic of Korea group. "We've identified some IP addresses that match the VPN choices by a certain DPRK group," Chen said. "The pattern looks very much like what the North Korean team did before." Onchain researcher Specter traced some of the stolen XRP to an Ethereum address that received 68,808 USDT from a wallet previously tied to "AFX EXPLOITER," which had suspected involvement by TraderTraitor, a North Korea-linked group. North Korean hackers were tied to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack attributed by the FBI to North Korea. Bitget said law enforcement and security firms, including Mandiant and SlowMist, have been engaged.

Circle and Tether moved to freeze stablecoins in a wallet labeled "Bitget Exploiter 8" on Etherscan. Circle blacklisted the address at 05:00 UTC on Friday, and Tether followed roughly seven hours later, locking approximately 99,990 USDC and 218,023 USDT in place, according to blockchain security firm MistTrack. The wallet also held about 170.47 ETH, which no issuer can freeze, and MistTrack's tracker shows other exploiter-linked addresses still hold more than 63,000 ETH. The freeze covers roughly $318,000 in stablecoins, a small fraction of the total haul, because the attacker raced to convert freezable assets into ETH before issuers intervened. Chen said some stolen funds had been recovered, without specifying an amount, and the exchange is working with blockchain foundations and other partners on recovery efforts.

Market reaction was muted relative to the size of the breach. Bitget's native token, BGB, fell sharply after the news circulated but had partially recovered by 22:10 UTC on September 24, down 2.9% at press time. Bitcoin's price was down approximately 0.29% and ether's price was down 0.2% over the prior 24 hours. Bitget, officially registered and headquartered in Seychelles, is one of the top 10 cryptocurrency exchanges by trading volume and serves more than $125 million users globally. The September breach follows the Liquid Network losing $320 million earlier in the month to another exploit, in which the attackers claimed to be "white hat hackers."