Threat intel

At 18:31 UTC on September 24, 2026, Bitget's monitoring flagged unauthorized transfers moving out of a limited number of its hot and warm wallets. By the time the exchange had traced the damage, roughly $351.6 million in crypto assets was gone across seven blockchains: Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base. Blockchain analytics firm Arkham Intelligence tracked around $350 million leaving five Bitget wallets in the hours after detection, and Bitget later said the figure could still move as it finishes tracing assets on additional chains.

Bitget's cold wallets, the offline storage holding the large majority of platform funds, were never touched, and customer account balances stayed accurate throughout. The exchange paused withdrawals as a precaution and covered the entire loss from its User Protection Fund rather than from customer deposits. For any organization that custodies cryptocurrency at scale, this incident is less a story about one exchange's bad day and more a live example of how wallet architecture and insurance-fund sizing decide whether a hot wallet breach becomes a customer-facing disaster or a contained, fully absorbed loss.

How it works

Exchanges split custody into three tiers. Cold wallets keep keys fully offline, air-gapped from any network, and typically hold most of an exchange's reserves; moving funds out of cold storage needs manual, often multi-person, physical steps, which makes it slow and secure. Hot wallets sit at the other end: keys live on internet-connected systems so the exchange can process customer withdrawals automatically, around the clock, without a human approving every transaction. Warm wallets are the middle tier, holding more automation than cold storage but with extra controls, such as multi-party approval or transaction limits, layered on top of a hot wallet's connectivity.

A hot wallet is a necessary evil. Any exchange that lets customers withdraw crypto on demand needs some pool of funds that a system can move without waiting for a human, or withdrawals would take hours instead of minutes. That pool is also the only part of the custody stack an attacker can reach without physical access, which is why it is the layer that gets hit.

Bitget says the theft did not involve stolen private keys. Instead, attackers compromised a backend system involved in wallet operations and used it to feed manipulated transaction data into Bitget's own internal authorization process, which then approved the fraudulent transfers as if they were legitimate. Bitget has not disclosed how the attackers first got into that backend system, how long they had access, or which specific service was compromised, and says the investigation, run with Mandiant and the blockchain forensics firm SlowMist, is ongoing.

This class of breach, an approval layer tricked into moving funds rather than keys stolen outright, usually traces back to one of a few root causes: compromised signing infrastructure reachable from inside the network, stolen API credentials or session tokens that let a script call the same approval endpoints a legitimate system would, a compromised co-signer in a multisignature (multisig) setup where several parties must each approve a transaction, or a supply-chain compromise of the wallet management software itself. Bitget has not said which one applies here.

What attackers are doing

Bitget CEO Gracy Chen said investigators found IP addresses used in the attack that match VPN infrastructure previously associated with a North Korea-linked hacking group, and that the intrusion pattern resembles techniques seen in earlier North Korean operations. She was careful to frame this as a preliminary finding, not a confirmed attribution, and said Bitget has ruled out an inside job. No formal attribution has been published, and no arrests have been announced.

Attribution like this typically takes weeks of forensic work to confirm, if it is confirmed at all, so Chen's caution is reasonable. The documented pattern it resembles belongs to Lazarus Group, the loose name researchers use for North Korean state-linked hacking activity, which has spent years running exactly this kind of operation against exchanges: the 2022 Ronin Bridge theft of over $600 million, the record $1.5 billion Bybit hack in February 2025, and a string of smaller exchange and wallet compromises in between, according to TRM Labs and other blockchain-security firms that track the group. The playbook is consistent: get access to an exchange's backend or signing infrastructure, move funds across as many chains and assets as possible before anyone can freeze them, then launder the proceeds through swaps and mixers. Bitget's own on-chain activity fits that last step, with roughly $183 million of the stolen funds converted into Ether shortly after the theft, a common way to move value into a more liquid, easier-to-route asset before it hits exchanges or bridges that might flag it.

Seven separate blockchains being hit in the same incident matters, too. A bug in one chain's smart contract or bridge would explain a loss on that one chain; losing funds simultaneously across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base points to something more central, a backend system or approval process Bitget uses to manage wallets across all of those networks, rather than a flaw specific to any one of them. XRP Ledger took the single largest chain loss, roughly 102.93 million XRP worth about $157.5 million, followed by 31,890 ETH worth roughly $85.75 million.

What to do if you custody crypto at scale

This applies to exchanges, but also to any corporate treasury, custodian or trading desk holding meaningful cryptocurrency balances online.

• Cap hot wallet balances to near-term liquidity. Keep only what covers expected withdrawal volume over the next operating cycle, whether that is hours or a day, in hot wallets. Everything beyond that belongs in cold storage, so a hot wallet compromise caps out at a known, bounded amount rather than draining reserves.
• Require multi-party approval above a set threshold. Any transfer over a defined dollar amount should need sign-off from more than one person or system, ideally through hardware-backed multisig where the co-signers do not share infrastructure or credentials, so compromising one does not compromise the approval.
• Monitor signing and withdrawal infrastructure for anomalies, not just wallet balances: unusual transaction volume or velocity, signing requests outside normal hours, new destination addresses that have never received funds from your organization before, and any change to the data an approval system is shown immediately before it signs.
• Size an insurance or protection fund to a plausible hot-wallet-loss scenario, not a token amount. Bitget's User Protection Fund held more than $464 million against the incident and covered the full $351.6 million loss with roughly $112 million to spare. A fund sized well below what a hot wallet could plausibly lose does not protect customers when it matters.

If you hold assets on Bitget

Bitget says customer balances were not directly at risk and deposits and trading continued operating normally throughout. Even so, check your recent withdrawal history around September 24 for anything you did not initiate. Confirm whether any assets you hold there sit on the seven affected chains: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain or Base. Watch Bitget's official support channel and status announcements for its post-incident report and for the withdrawal resumption timeline, which the exchange said it would confirm once ready rather than commit to a date it could not guarantee.

If your organization holds a treasury wallet, runs a trading desk, or operates smart contracts that move customer funds, our smart contract audits team reviews the accounting and access control behind that custody, and our security operations team can help you build the anomaly detection this kind of incident depends on catching early. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: The Hacker News, TRM Labs, BleepingComputer, Hackread, Security Affairs, Bloomberg, Bitget Support Center.