Bitget Hot Wallets Hit for $387.5M; Exchange Blames Spoofed Slips, Not Stolen Keys 🕵️

Crypto exchange Bitget disclosed that roughly $387.5 million in digital assets were drained from its hot and warm wallets on September 24, 2026, revising an initial estimate of $351.6 million to include additional transfers on Zcash and TRON. The updated figure was based on onchain tracing of funds sent to attacker-controlled addresses, the company said, adding that the incident "remains contained and no further unauthorized transfers are possible." Bitget CEO Gracy Chen said the exchange's security systems detected unauthorized transfers at 18:31 UTC and that emergency response protocols were activated immediately.

Chen said attackers compromised a backend system within Bitget's wallet infrastructure, used it to spoof transaction data, and triggered the exchange's authorization process to move funds out. "Private key compromise has been ruled out," Chen wrote on X, adding that "they did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet." Cold wallets "remain fully secure," she said, and Bitget operates a three-tier wallet architecture in which only portions of the hot and warm wallet layers were breached. Deposits and trading remain open, while withdrawals are temporarily suspended pending a security review. Bitget said it would publish a comprehensive incident report within 24 hours and is working with Mandiant and SlowMist.

On-chain researchers traced the outflow beginning with a freshly created address that spent $19.67 million in USDT0 to buy 7,111 ETH in six minutes via UniswapX and 1inch Fusion, paying roughly 5% above market. Within an hour, approximately $183 million had moved from wallets labeled as belonging to Bitget into a single destination address. Arkham Intelligence analyst Emmett Gallic said the transactions involved three Bitget hot wallets and one cold wallet across multiple blockchains, with funds consolidated into address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee. Stolen assets included ETH, BNB, AVAX, USDC, USDT, USDT0, XAUt, XRP, ZEC and TRX. Lookonchain reported nearly 102.9 million XRP, valued at roughly $157.5 million, making XRP the largest single component of the haul.

Circle blacklisted a wallet labeled "Bitget Exploiter 8" on Etherscan at 05:00 UTC on September 25, and Tether followed several hours later, together freezing about $318,000 in stablecoins. The wallet also held around 170 ETH, but blockchain trackers showed other exploiter-linked addresses still holding more than 63,000 ETH that no issuer can freeze. During a live Q&A on X, Chen said some stolen funds had been recovered, without specifying an amount. "User funds are safe. The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million," Chen said. Bitget's native token BGB was down 2.9% as of 22:10 UTC on September 24, while Bitcoin's price was down 0.29% and Ether's price was down 0.2% over the prior 24 hours.

Chen told the X audience that investigators had identified IP addresses matching VPN choices used by "a certain DPRK group," referring to the Democratic People's Republic of Korea, and said the pattern resembled prior North Korean attacks. On-chain researcher Specter said they traced some stolen XRP to an Ethereum address that had received 68,808 USDT from a wallet that previously sent funds to an address labeled "AFX EXPLOITER," which AFX has linked in its postmortem to TraderTraitor, a North Korea-linked group. Bitget's updated report did not address the North Korea speculation. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack attributed to the country by the FBI.

Bitget CEO Gracy Chen publicly asked THORChain to refuse transactions from the identified hacker wallets, writing, "Decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching." THORChain declined, stating that its network is "permissionless," and asked what responsibility Bitcoin, Ethereum and BNB Chain bear when handling known stolen funds. Blockchain analytics firm MistTrack reported that nearly $1.2 billion in stolen Bybit funds were traced through THORChain after the February 2025 Bybit hack. Bitget, officially registered and headquartered in Seychelles, is among the top 10 cryptocurrency exchanges by trading volume, serving over $125 million users globally.