Cryptocurrency exchange Bitget has confirmed that unauthorized transfers totaling an estimated $351.6 million occurred from parts of its hot and warm wallet infrastructure on September 24, 2026.
The exchange said its systems detected the activity at approximately 18:31 UTC. It immediately activated emergency response protocols and temporarily suspended withdrawals as a precaution.
Deposits and trading remained operational.
In an official security notice signed by CEO Gracy Chen, Bitget stated that the incident was limited to portions of the hot and warm wallet layers. Cold wallets were unaffected. The company estimated the affected funds at about $351.6 million and said the loss falls within the coverage of its User Protection Fund, which it reported holds more than $464 million.
“User funds are safe. The full amount of this loss falls within the coverage of Bitget’s User Protection Fund, which currently holds over $464 million,” the exchange said.
RELATED
→ How to Pay for International Subscriptions and Services from Nigeria
→ Beijing Rejects Anthropic CEO’s Call to Limit China’s AI Development
How the attack worked (according to Bitget)
In a subsequent update, Chen explained that attackers compromised a critical backend system connected to the wallet infrastructure. They used it to spoof transaction data and trigger the exchange’s authorization process to move funds out. Private-key compromise has been ruled out, and the company said it has contained the incident so that no further unauthorized transfers are possible.
Investigations into exactly how the backend system was accessed are ongoing. Bitget said it will publish a full technical report once findings are confirmed.
Affected assets
The stolen assets included Ethereum (ETH), XRP, BNB, Avalanche (AVAX), Tether (USDT), USD Coin (USDC) and other tokens, spanning the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base networks. Chen confirmed that all on-chain cold wallets were checked and remain secure. Bitget also contacted foundations of the affected networks; some confirmed that certain attacker-linked addresses had been frozen.
Attribution
Chen stated that analysis of IP behavior patterns and on-chain activity showed the method was “highly consistent with known patterns of North Korean hacker organizations.” The exchange reported the incident to relevant authorities and is cooperating with a global investigation. This attribution remains preliminary and is based on Bitget’s internal analysis.
Bitget Wallet (the company’s separate decentralized product) was not affected, as it operates independently of the exchange infrastructure.
Current status
Technical teams are working to remediate the affected systems and strengthen security.
Withdrawals remain suspended with no firm timeline announced. Chen said the goal is full recovery as soon as possible and that the company will announce a specific window only once it can be confirmed. Bitget has notified law enforcement and blockchain security firms and earlier indicated it would provide frequent updates plus a full incident report within 24 hours of the initial disclosure.
Post a Comment