Bitget's $387.5M Hot-Wallet Heist: Paperwork Forgery, Not Key Theft 🔑🚪

Crypto exchange Bitget confirmed that roughly $387.5 million in digital assets were drained from portions of its hot and warm wallet infrastructure in an attack detected at 18:31 UTC on September 24, 2026, according to CEO Gracy Chen. The figure was revised upward from an initial $351.6 million estimate after onchain tracing added affected holdings on Zcash and TRON that were not included in the first accounting. Bitget, officially registered and headquartered in Seychelles and ranked among the top 10 exchanges globally by trading volume, said cold wallets were not compromised and that private keys were not stolen.

Chen said attackers compromised a critical backend system within the exchange's wallet infrastructure, used it to spoof transaction data and triggered Bitget's own authorization process to move funds out. "Private key compromise has been ruled out," she wrote on X, later adding during a live Q&A that "they did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet." Bitget said the outflow has been stopped and no further unauthorized transfers are possible. Deposits and trading remain online while withdrawals are temporarily suspended pending a security review; the company pledged a full incident report within 24 hours.

Onchain investigators traced assets moving across multiple blockchains to attacker-controlled addresses. Researcher Emmett Gallic of Arkham Intelligence said three hot wallets and one cold-wallet-linked address on multiple chains consolidated funds into a single address, including ETH, BNB, AVAX and USDT0. Pseudonymous researcher DCF GOD flagged a fresh wallet that spent $19.67 million in USDT0 on 7,111 ETH in six minutes via UniswapX and 1inch Fusion, paying roughly 5% above spot. Lookonchain later reported approximately 102.9 million XRP stolen, valued at nearly $157.5 million, making XRP the largest single stolen asset. Other assets included ETH, BNB, AVAX, USDC, USDT, USDT0, XAUt, ZEC and TRX.

The company's User Protection Fund, which holds over $464 million, will cover the loss, and Chen said customer balances remain accurate. Circle blacklisted an address labeled "Bitget Exploiter 8" on Etherscan at 05:00 UTC on Friday, and Tether subsequently banned the same wallet, together freezing about 99,990 USDC and 218,023 USDT, roughly $318,000, according to blockchain security firm MistTrack. Other exploiter-linked addresses still hold more than 63,000 ETH, which no issuer can freeze. Onchain researcher Specter and Chen separately pointed to potential links with North Korean actors; Chen cited IP addresses matching VPN services used by a Democratic People's Republic of Korea group, and Specter traced stolen XRP to an address that had received funds from a wallet labeled "AFX EXPLOITER," linked in a prior postmortem to TraderTraitor. Investigators from Mandiant and SlowMist are supporting the forensic review, which remains ongoing. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack the FBI attributed to North Korea.

The attacker has continued moving assets since the breach. A wallet linked to the exploit executed 27 swaps between approximately 03:55 and 06:23 UTC on Monday, converting roughly 2,390 ETH to about 75.2 BTC through the cross-chain protocol THORChain, which received approximately $6.3 million in ETH according to onchain data; a single receiving address received the BTC. Bitget publicly asked THORChain to refuse services to addresses tied to the attack, with Chen stating "decentralization is a design principle, not a shield for facilitating known stolen funds. The industry is watching." THORChain declined, writing "What responsibility should Bitcoin, Ethereum, and BNB Chain bear when handling known stolen funds?" THORChain has paused or halted its network in past incidents, including after a 2021 hack and a January 2025 freeze of lending and savings products, and blockchain tracker MistTrack reported that nearly $1.2 billion in assets stolen from the February 2025 Bybit attack was traced through THORChain. Bitget's native token, BGB, fell sharply after the hack began circulating and was down 2.9% by 22:10 UTC on September 24; $BTC was down about 0.29% and $ETH was down about 0.2% over the prior 24 hours.