Bitget's $388M Hot Wallet Heist: Forged Paperwork, Frozen Stablecoins, and One Unfazed Cross-Chain Swap

Crypto exchange Bitget has revised the damage from its September 24 security breach to approximately $387.5 million, up from the $351.6 million initially reported, the company said in an updated incident report. The exchange said $387.5 million were transferred to attacker-controlled addresses based on onchain tracing and that the revised figure reflects a more complete accounting of transfers, including affected assets on Zcash and TRON that were not included in the initial estimate. Bitget added that the incident remains contained and no further unauthorized transfers are possible.

Bitget CEO Gracy Chen said the company's security systems detected unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24, 2026, and that emergency response protocols were activated immediately. Chen said attackers compromised a critical backend system within Bitget's wallet infrastructure, used it to spoof transaction data and triggered the exchange's authorization process to move funds out, adding, "Private key compromise has been ruled out." She also wrote, "They did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet." Bitget operates a three-tier wallet architecture, and Chen said the breach affected only a portion of the hot and warm wallet layers, with cold wallets remaining secure. Deposits and trading remained online while withdrawals were temporarily suspended pending a security review.

Onchain researchers had flagged the activity before Bitget confirmed it. Emmett Gallic, an analyst at Arkham Intelligence, said in posts on X that roughly $183 million in assets moved from wallets labeled as belonging to the exchange into a newly created address. Pseudonymous researcher DCF GOD reported that a fresh wallet beginning with "0xe410" took $19.67 million in USDT0 and swapped it for 7,111 ETH in six minutes via UniswapX and 1inch Fusion, paying up to 5% above market rates. According to Lookonchain, about 102.9 million XRP, worth roughly $157.5 million, was also stolen, making XRP the largest single asset taken. Other stolen assets included ETH, BNB, AVAX, USDC, USDT, XAUt, ZEC and TRX.

In a live Q&A on X, Chen said investigators had identified IP addresses matching VPN choices associated with a North Korean group, stating, "We've identified some IP addresses that match the VPN choices by a certain DPRK group," and "The pattern looks very much like what the North Korean team did before." She added that the exchange did not believe the breach was an inside job. In later comments to Cointelegraph, Chen said the exploit stemmed from a vulnerability in a third-party security product that allowed the attacker to obtain "high-level internal credentials," and described her earlier North Korea assessment as based on "preliminary indicators identified during the investigation." North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack, which the FBI attributed to North Korea.

Circle and Tether froze a wallet linked to the exploit, labeled "Bitget Exploiter 8" on Etherscan, locking roughly $318,000 in stablecoins. Circle blacklisted the address at 05:00 UTC Friday, and blockchain security firm MistTrack said Tether later banned the same wallet. Other exploiter-linked addresses still hold more than 63,000 ETH, which no issuer has the authority to freeze. Bitget asked cross-chain protocol THORChain to refuse transactions from addresses tied to the attack, with Chen writing, "Decentralization is a design principle, not a shield for facilitating known stolen funds." THORChain pushed back, asking, "What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?"

Chen said Bitget's User Protection Fund, which holds over $464 million, will cover the full reported loss, and wrote, "User funds are safe." Bitget said it would publish a comprehensive incident report within 24 hours and has launched a bounty program to incentivize freezing or recovering the assets, while investigations with Mandiant and SlowMist continue.