Bitget Puts Losses From Sept. 24 Hack at About $387.5 Million, the Largest Crypto Theft Reported So Far in 2026
The exchange says attackers broke into a backend wallet system and tricked its own approval process into sending funds out, and it says its protection fund will cover customer balances as withdrawals restart in stages starting Sept. 28.
A Company That Says It Never Lost Its Keys, But Lost $387.5 Million Anyway
At 6:31 p.m. UTC on September 24, 2026, alarms went off inside Bitget, one of the world's larger cryptocurrency exchanges. Money was leaving its wallets, and nobody inside the company had told it to go[1][2]. By the time engineers froze withdrawals, roughly $387.5 million in crypto was gone, making it the largest crypto theft reported so far in 2026[12][13].
Here's the detail that makes this hack different from a simple robbery: Bitget says its private keys, the digital passwords that unlock its wallets, were never stolen[4][14]. Normally, a theft that size means someone found the keys. This time, the company says, attackers didn't need them. They broke into a backend system and fed it fake transfer orders, and Bitget's own approval process signed off on the fakes as if they were real[4][15]. That distinction sits at the center of almost everything that happened next.
How You Rob a Vault Without Finding the Combination
To understand what Bitget says happened, it helps to know how exchanges store money. They split it into three types of wallets. "Hot" wallets stay connected to the internet so withdrawals can process in minutes. "Cold" wallets sit offline, disconnected and slow to use, which also makes them hard for a hacker to reach. "Warm" wallets are a middle step between the two[1][14].
Whatever sits online carries risk. If someone can trick the system into approving a transfer, it doesn't matter that the keys themselves stayed locked away. A wallet "signs" a transfer using its private key, the way a signature authorizes a check. One way to steal money is to steal the key. The other way is to fool the software that decides what to sign, so it approves a forged request without knowing it's fake[4][15].
Security firm Hypernative, which studies these attacks, says that's what happened here: "spoofed requests" convinced Bitget's own wallets to sign away the funds[15]. Bitget's cold storage, offline and out of reach, was never touched[4][14]. That's why the company can truthfully say its keys are safe, and why critics can just as truthfully point out that $387.5 million still walked out the door under a system built to stop exactly that.
A Number That Grew, and a Fund Meant to Cover It
Bitget's first estimate of the damage was $351.6 million. Days later, once the company finished counting stolen Zcash and TRON tokens, it revised the total to about $387.5 million[3][12][13]. Reports describe 19 separate outgoing transfers during the breach[10].
Bitget says it has a User Protection Fund worth more than $464 million, and that this fund will absorb the entire loss. Customer account balances, the company says, were never actually changed[1][8]. But by Bitget's own numbers, covering the loss shrinks that cushion to under $77 million until it's refilled[1][12].
That's the gap between a promise and proof. A customer's balance on Bitget's app is really a claim on money the exchange says it's holding elsewhere. Whether that claim is good depends entirely on trusting the company's account of its own fund. The real test lands in stages: bitcoin withdrawals reopen September 28, ether on September 29, the USDT stablecoin on September 30, and everything else on October 2[12]. Trading and deposits, notably, stayed open throughout[2].
The Suspect Everyone Names and No One Has Proven
Bitget's CEO, Gracy Chen, has said she suspects North Korea was behind the attack. She points to internet addresses tied to VPN services a North Korean hacking group has used before. She has also said, clearly, that this attribution isn't yet confirmed[8][10].
The suspicion isn't coming from nowhere. Analysts estimate North Korea-linked groups were behind roughly two-thirds of all stolen crypto value in the first half of 2026 alone[17]. Bloomberg reported that if Bitget is added to that tally, North Korea's crypto theft haul for the year would top $1 billion[11]. Some reports describe a fake job interview used to lure a Bitget employee, a tactic long associated with North Korea's Lazarus Group, though that detail comes from secondary reporting rather than a Bitget statement[19][16].
Other security researchers are more cautious. VPN addresses can be shared, reused, or deliberately faked to point investigators the wrong way, and no technical evidence had been published as of the reports reviewed here[16]. North Korea has historically denied involvement in crypto thefts, and no response from the country turned up in coverage of this incident. The fair point in its favor, for now, is a procedural one: the accusation rests on one company's preliminary read of network data, and even that company says it isn't confirmed[10][16].
Markets Barely Blinked, Except for One Token
If the hack were shaking confidence in crypto broadly, you'd expect prices to move. They mostly didn't. CoinDesk's market wrap the next day was headlined "Crypto shrugs off Bitget's $351.6 million hack," and bitcoin drifted only about 0.3%, staying near $84,000[6]. That undercuts the idea, circulating in some coverage, that the hack was still "weighing on" crypto markets broadly.
One token did move: Bitget's own BGB fell about 5% after the news[5]. That's the market drawing a distinction between an exchange's individual problem and the health of crypto as a whole. September's total reported hack losses across the industry passed $684 million, the highest monthly figure of 2026, with Bitget accounting for the bulk of it[18].
For scale, the previous largest theft of 2026 was the $292 million Kelp DAO bridge exploit in April[17]. Both are dwarfed by the roughly $1.46 billion stolen from the exchange Bybit in February 2025, still the largest crypto heist on record[20].
What Gets Emphasized Depends on Who's Writing
Coverage of the hack split less on politics than on which detail different outlets chose to lead with. Fortune's headline read "North Korea accused of plundering Bitget for $387 million," using a vivid verb and putting the accusation up front without immediately noting that the accuser is the victim company itself[7]. Gizmodo's headline called North Korea "Very Likely" responsible, putting Chen's hedged suspicion into the top line while her own caveat that it's unconfirmed sat further down in the body[10].
Bloomberg and CNBC, by contrast, kept the attribution explicit and close to the source, describing funds as "affected" and stating plainly that Bitget "suspects" North Korea, rather than asserting it as fact[2][8]. Crypto trade outlets like CoinDesk and Bloomingbit leaned toward reassurance and logistics, one putting "safe" in scare quotes while the other led with the withdrawal restart schedule[6][13]. No right-leaning U.S. outlets covered the story in the search behind this piece, and no coverage from North Korea, China, Russia, or Gulf state media appeared either, leaving the debate largely confined to business and crypto trade press[7].
What happens between now and October 2, when the last funds are supposed to become withdrawable again, is the part nobody has been able to report yet, because it hasn't happened.
Summary
Bitget is one of the world's larger cryptocurrency exchanges. It says attackers drained money from its internet-connected wallets on Sept. 24, 2026[1][2]. It first put the loss at $351.6 million[2][3]. It later raised the estimate to about $387.5 million once stolen Zcash and TRON tokens were added[12][13]. Trackers say that makes it the largest crypto theft reported so far in 2026. The previous biggest was the $292 million Kelp DAO bridge exploit in April[17]. It is still far smaller than the roughly $1.46 billion taken from exchange Bybit in February 2025[20].
Bitget says the attackers did not steal the secret 'private keys' that control its wallets. Instead, they broke into a backend system and fed it fake transfer requests. Bitget's own approval system then signed off on those requests as if they were real[4][14][15]. The company says its User Protection Fund, which it puts at more than $464 million, covers the full loss. It also says customer account balances were never changed[1][8]. Withdrawals were frozen. Bitget says they restart in stages: bitcoin on Sept. 28, ether on Sept. 29, the USDT stablecoin on Sept. 30, and everything else on Oct. 2[12].
The main open question is who did it. Bitget CEO Gracy Chen says she suspects North Korea. She says investigators found internet addresses tied to VPN services a North Korean hacking group has used before. She also said the attribution is not yet confirmed[8][10]. As of the reports we reviewed, no technical evidence had been published, and some analysts questioned a direct link to North Korea's Lazarus Group[16]. Bloomberg reported that if North Korea is responsible, its crypto thefts in 2026 would top $1 billion[11].
One framing in circulation does not hold up. Claims that the hack is 'weighing on' crypto markets are not supported by same-day market data. CoinDesk reported that crypto 'shrugs off' the hack. Bitcoin moved about 0.3% and stayed near $84,000. Bitget's own BGB token fell about 5%[6][5].
The Event
At 18:31 UTC on Sept. 24, 2026, Bitget's systems detected unauthorized transfers out of some of its hot and warm wallets. That was Thursday afternoon in the U.S. and early Sept. 25 in Asia[1][10]. Reports described 19 outgoing transfers[10]. Bitget froze withdrawals but kept deposits and trading open. It first estimated the loss at $351.6 million, then revised it to about $387.5 million[2][3][12]. The company hired security firms Mandiant and SlowMist to investigate[9][12].
Undisputed Facts
- Bitget detected unauthorized transfers from some of its hot and warm wallets at 18:31 UTC on Sept. 24, 2026[1][2].
- Bitget's first estimate of the loss was $351.6 million. It revised this to about $387.5 million after counting Zcash and TRON assets[3][12][13].
- Bitget says its offline 'cold' wallets were not touched and that no private keys were compromised[4][14].
- Bitget says its User Protection Fund holds more than $464 million and will cover the full loss[1][8].
- Bitget says withdrawals resume in stages: bitcoin on Sept. 28, ether on Sept. 29, USDT on Sept. 30, and remaining tokens, fiat and peer-to-peer services on Oct. 2[12].
- Bitget offered a bounty of 5% to platforms that freeze the attacker's funds, plus another 5% if funds are recovered[9].
- Before this hack, the largest theft of 2026 was the $292 million Kelp DAO bridge exploit on April 18[17]. The all-time record is the roughly $1.46 billion Bybit theft of February 2025[20].
- Bitget CEO Gracy Chen has named North Korea as the suspect. She has also said this is not yet confirmed[8][10].
The Pressure
Strip away the moralizing and blame. What structural realities persist regardless of which narrative wins?
- Hot wallets are a built-in tradeoff
- Exchanges keep some funds in 'hot' wallets connected to the internet so withdrawals can happen in minutes. 'Warm' wallets sit in between. 'Cold' wallets are offline and slow to use but hard to reach. Whatever sits online can be drained if the system that approves transfers is fooled. That is why the loss was capped at the hot and warm wallets, and why the cold wallets were safe[1][14].
- Approval systems trust their inputs
- A wallet 'signs' a transfer with its private key, which works like a digital signature. Stealing the key is one way in. The other way is to feed false requests to the software that decides what to sign. Bitget and Hypernative say attackers did the second. They got into a backend system, forged the transfer data, and let Bitget's normal signing process do the rest[4][15]. This matters to both sides of the debate. Bitget can truthfully say its keys were never stolen. Critics can truthfully say its controls still approved $387.5 million in fake transfers.
- Trust is the product
- An exchange's customer balance is a promise to pay. That is why Bitget stresses its $464 million+ fund and a firm restart date. If customers doubt the promise, they withdraw at once, and that is the real risk to an exchange after a hack[1][12].
- State-linked theft
- Analysts attribute about two-thirds of stolen crypto value in the first half of 2026 to North Korea-linked groups[17]. That background makes the North Korea suspicion plausible. It is not proof in this case[16].
Material realityAbout $387.5 million in crypto left Bitget's wallets. It is now under attacker control, and tracing continues. Bitget says the total could still change[12]. Bitget says it will absorb the loss from its own fund, so customer balances are unchanged on paper[1]. The staged restart of withdrawals from Sept. 28 to Oct. 2 is the practical test of that promise[12]. The wider market barely moved in the first day, while Bitget's own token fell about 5%[5][6]. September's reported hack losses passed $684 million, the highest monthly total of 2026[18].
Narrative as a weaponBitget is doing the most to shape perception. It wants readers to believe three things: no private keys were stolen, customers are fully covered, and a state-backed attacker was to blame. Each claim is attributed to the company, and the last is explicitly unconfirmed[4][8][10]. Security vendors frame the hack as proof that approval systems need their kind of monitoring[15]. General news headlines tend to lead with North Korea because a state villain is the most gripping angle[7][10]. Crypto trade press leans toward market resilience and the restart timeline, which reassures its industry audience[6][13]. Some framings attached to this story are wrong. The drain began Sept. 24 UTC, not Sept. 25. And same-day market data does not support the claim that the hack is 'weighing on' crypto prices[1][6].
How Each Side Sees It
Each major actor’s view — how it frames things, its underlying incentive, and how it’s materially affected. Tap a side to read it.
Frames it asBitget argues the system worked where it counted. It says the loss was capped to internet-connected 'hot' and 'warm' wallets. Its cold storage and private keys were untouched[4][14]. It says a pre-funded protection fund bigger than the loss means no customer loses a cent of their balance[1][8]. It points to fast disclosure, outside forensics by Mandiant and SlowMist, and a public restart schedule as signs of an exchange handling a crisis responsibly[12]. Naming a state-backed attacker frames Bitget as the victim of a nation-level threat that has also beaten other major firms[8][11].
WhyStop customers from pulling their money when withdrawals reopen, protect the value of its BGB token, and keep its reputation as a safe place to trade[5][12].
Impact on themThe exchange absorbs the loss from its own fund, which it says holds $464 million+. By its own figures, that shrinks the cushion to under $77 million until it is refilled[1][12]. BGB fell about 5% after the news[5].
Frames it asCustomers' strongest point is simple: a promise is not money in hand. Their funds were locked for days. The real test is whether withdrawals actually open on schedule. Bitget says account balances were never changed[1]. But a user's balance is only a claim on assets the exchange holds. Customers must trust Bitget's word that the protection fund is real and big enough[8][12].
WhyGet full, prompt access to their funds and some assurance the same hole cannot be used again[12].
Impact on themWithdrawals were frozen from Sept. 24, with a staged restart running from Sept. 28 to Oct. 2[12]. Trading and deposits stayed open[2].
Frames it asThis camp's key point is about how the hack worked. The attackers did not need the keys. They fooled the machine that uses the keys. Security firm Hypernative describes 'spoofed requests' that got Bitget's own wallets to sign the transfers[15]. The lesson, in this view, is that wallet approval systems must check where a request came from, not just whether it is formatted correctly. On who did it, some analysts urge caution. VPN addresses can be shared or faked, and no technical evidence had been published[16]. Other investigators point to a pattern that matches North Korean methods. Reports describe a fake job interview used to win over a Bitget employee, a tactic long tied to Lazarus. That claim comes from secondary reports, not a Bitget statement[19][16].
WhySecurity firms sell monitoring and forensics, so a high-profile breach showcases their products and expertise[15].
Impact on themTheir findings on how the attackers got in, and who they were, will shape how other exchanges fix the same weakness and whether funds can be frozen[9][15].
Frames it asWe found no response from North Korea in the coverage we reviewed. It has historically denied involvement in crypto thefts. The fair point in its favor is procedural. So far the accusation rests on one company's preliminary claim about VPN addresses. Chen herself has said it is unconfirmed[10][16].
WhyWestern governments and researchers say North Korea uses crypto theft to raise hard currency despite sanctions. That is the context behind Bloomberg's tally of more than $1 billion in 2026 if Bitget is included[11][17].
Impact on themIf attribution is confirmed, the hack adds to sanctions-enforcement pressure and to efforts to freeze laundered funds[9][11].
Like this article?
The Bias Ledger average rating 2.9
The same story, as framed by outlets across the spectrum, ordered least to most biased. The bias score (1 = straight, 10 = heavily spun) is an AI assessment of that framing — click an outlet to see its track record. The tell is the word choice or omission that reveals the angle.
| Outlet | Vantage | Bias | How they frame it | The tell |
|---|---|---|---|---|
| Bloomberg | U.S. center (business) | 2 | Bitget Says $351 Million Affected in Breach, Halts Withdrawals | Adopts the company's softer word 'affected' rather than 'stolen', though it attributes the claim with 'says'. A follow-up piece frames the story around North Korea's running 2026 total. |
| CNBC | U.S. center (business) | 2 | Crypto platform Bitget suspects North Korea is responsible for $352 million hack | Clearly assigns the North Korea claim to Bitget ('suspects'). This is straight attribution. |
| Bloomingbit | South Korean crypto trade press | 2 | Bitget to Resume Withdrawals From Sept. 28 After $387.5 Million Asset Drain | Leads with the customer-service angle (when money comes back), using the neutral 'asset drain'. |
| CoinDesk | Crypto trade press (owned by Bullish, a crypto exchange operator) | 3 | Crypto shrugs off Bitget's $351.6 million hack as altcoins rally | Frames the story through market resilience, which suits an industry audience. Its first-day piece put 'safe' in scare quotes, a sign of skepticism toward the company. |
| Blockhead | Singapore crypto trade press | 3 | Bitget Loses $351.6 Million in Hot Wallet Breach, Rules Out Private Key Compromise | Gives headline space to the company's main reassurance, without attribution beyond the subject 'Bitget'. |
| Fortune | U.S. center (business) | 4 | North Korea accused of plundering Bitget for $387 million in year's biggest crypto attack | 'Plundering' is a vivid verb, and North Korea leads the headline. The 'accused' does honest work, but the headline does not say the accuser is the victim company itself. |
| Gizmodo | U.S. left-leaning tech | 4 | North Korea 'Very Likely' Behind $388 Million Hack of Crypto Exchange Bitget | Puts a hedged suspicion in the headline as the main news. The CEO's caveat that attribution is unconfirmed carries less weight than the quote marks. |
References
- [SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026 — Bitget Support Center · Primary source; the affected company's own statement
- Bitget Says $351 Million Affected in Breach, Halts Withdrawals — Bloomberg · U.S. business wire, center; owned by Bloomberg L.P.
- Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise — The Hacker News · Cybersecurity trade press, ad-funded
- Bitget's $352 million hack happened via spoofed transfers, not private keys, CEO Gracy Chen says — CoinDesk · Crypto trade press; owned by Bullish, a crypto exchange operator
- Crypto exchange Bitget says $352 million affected in a hack, claims user funds are 'safe' — CoinDesk · Crypto trade press; owned by Bullish, a crypto exchange operator
- Crypto shrugs off Bitget's $351.6 million hack as altcoins rally: Crypto Markets Today — CoinDesk · Crypto trade press; owned by Bullish, a crypto exchange operator
- North Korea accused of plundering Bitget for $387 million in year's biggest crypto attack — Fortune · U.S. business magazine, center
- Crypto platform Bitget suspects North Korea is responsible for $352 million hack — CNBC · U.S. business TV/news, center; owned by Versant
- Bitget Hack Losses Climb to $387M: Here's What Happened, and Why North Korea Is a Suspect — Decrypt · Crypto trade press, industry-funded
- North Korea 'Very Likely' Behind $388 Million Hack of Crypto Exchange Bitget — Gizmodo · U.S. tech site, left-leaning; ad-funded
- Crypto Theft by North Korea Tops $1 Billion in 2026 After Bitget Attack — Bloomberg · U.S. business wire, center; owned by Bloomberg L.P.
- Bitget Withdrawals Resume September 28: Full Schedule After $387.5M Hack — The Crypto Times · Indian crypto trade press, industry-funded
- Bitget to Resume Withdrawals From Sept. 28 After $387.5 Million Asset Drain — Bloomingbit · South Korean crypto trade press
- Bitget Loses $351.6 Million in Hot Wallet Breach, Rules Out Private Key Compromise — Blockhead · Singapore crypto trade press
- Bitget's $387M hack: how spoofed requests got signed — Hypernative · Blockchain security vendor blog; commercial interest in selling threat monitoring
- Bitget Confirms $351.6 Million Hack, Suspects North Korea's Lazarus Group — Hackread · Cybersecurity trade press, ad-funded
- Top 15 Biggest Crypto Exploits of H1 2026: Nearly $1B Lost — FinanceFeeds · Fintech trade press, industry-funded
- Bitget's $351.6 million hack pushes September crypto losses to 2026 high — CryptoRank · Crypto data aggregator, industry-funded
- Bitget Hack Explained: How Lazarus Group Used A Fake Job Interview To Steal Millions — Coin Edition · Crypto trade press, industry-funded; secondary reporting
- The 10 Biggest Crypto Hacks in History — Crystal Intelligence · Blockchain analytics vendor; commercial interest in forensics services