Bitget Hack Update: $387.5 Million Stolen, Phased Withdrawal Restoration Under Way
Bitget Hack Update: What We Know So Far
Crypto exchange Bitget is working through the largest cryptocurrency hack of 2026 so far. The exchange has revised its loss estimate upward, pinned the attack on a backend wallet weakness, and started bringing withdrawals back online in stages.
Timeline of the Bitget Hack
Bitget's monitoring systems flagged unauthorised transfers at about 18:31 UTC on 24 September 2026. The exchange triggered its emergency procedures within minutes and paused all withdrawals, while deposits and trading stayed available.
Its first public estimate put the loss at roughly $351.6 million. The next day, Bitget raised the figure to about $387.5 million after on-chain tracing turned up additional stolen assets on the Zcash and TRON networks that the first count had missed.
How the Attack Worked
According to CEO Gracy Chen, the attackers got into a critical backend system inside Bitget's wallet infrastructure. From there they spoofed transaction data, which tricked the exchange's own authorisation process into releasing funds from hot and warm wallets.
Bitget says private keys were not leaked and that its cold wallets, along with the great majority of platform assets, were never touched. The self-custodial Bitget Wallet runs on separate infrastructure and was not affected.
The affected networks included Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base. Assets taken included XRP, ETH, USDT, USDC, BNB and AVAX, among others.
Suspected North Korean Involvement
Chen said on-chain analysis and the attackers' IP behaviour point to a North Korean group. One analyst has reportedly tied the stolen XRP to money flows from an earlier Lazarus-linked theft. North Korean actors were also blamed for the 2025 Bybit heist of about $1.5 billion, the biggest crypto theft on record. Attribution here is still a claim from Bitget and outside analysts, not a confirmed finding from law enforcement.
Bitget is investigating with Mandiant and SlowMist, and is cooperating with law enforcement agencies and on-chain security firms.
Withdrawals Return in Phases
On 28 September, Bitget began restoring withdrawals, starting with Bitcoin on the main network and BNB Smart Chain. Reports say thousands of withdrawal orders, totalling more than 4,000 BTC, were processed in the first hours.
The announced schedule was:
- 29 September: Ethereum
- 30 September: USDT
- 2 October: remaining assets, plus fiat and P2P services
Bitget has also promised to publish an official security report. We have not yet verified whether the schedule and report were delivered in full, so check Bitget's official channels for the latest status.
Who Pays for the Loss?
Bitget says the whole loss is covered by its User Protection Fund, which holds more than $464 million, mostly in about 5,500 BTC. The company says user account balances were unaffected throughout.
What Users Should Do
Hack aftermaths attract scammers. Users should:
- Use only Bitget's verified official channels for announcements
- Ignore unsolicited "refund" or "recovery" messages and links
- Enable two-factor authentication and anti-phishing codes
- Avoid keeping more funds on any single exchange than necessary
Why It Matters
The incident is another reminder that exchange security depends on the whole stack, not just key storage. An attack that manipulates how a system authorises transactions can succeed even when keys stay safe. Whether Bitget's response restores user confidence will depend on the promised security report and on how clearly the company explains the root cause.
This story is developing and will be updated as Bitget publishes further details.