Cryptocurrency exchange Bitget has suffered a security breach involving approximately $351.6 million in digital assets, after attackers compromised part of its hot and warm wallet infrastructure and triggered unauthorised transfers.
Bitget said its security systems detected the transfers at 18:31 UTC on Thursday, September 24, 2026, prompting the exchange to activate its emergency response procedures. Withdrawals were subsequently suspended while the company carried out a security review.
Bitget said its cold wallets were not affected and that customer account balances remained protected. The exchange also said deposits and trading were initially still available, although a subsequent notice on September 25, 2026 said its on-chain trading service had also been temporarily affected during the security review.
The exchange’s Chief Executive Officer, Gracy Chen, later said investigators had identified the attack path as a compromise of a critical backend system within the wallet infrastructure rather than a theft of private keys.
According to Chen’s account reported on September 25, the attackers used the compromised backend system to spoof transaction data and trigger Bitget’s own authorisation process to move funds. She said the investigation had ruled out a private-key compromise, although the precise method used to gain access to the backend system was still being investigated.
On-chain monitoring firm Lookonchain reported that the stolen assets included approximately 102.93 million XRP, valued at about $157.5 million at the time of its report, alongside 31,890 ETH, 34.75 million USDT, 21.05 million USDC and other digital assets. Lookonchain’s subsequent estimate put the total value of assets traced on-chain at about $356.8 million, higher than Bitget’s official preliminary estimate of $351.6 million.
The difference reflects the distinction between Bitget’s official estimate of the affected funds and subsequent on-chain valuations by blockchain analysts.
Bitget said the entire reported loss is covered by its User Protection Fund, which held more than $464 million at the time of the incident. The exchange said abnormal transfer addresses had been identified and reported, while law enforcement agencies and on-chain security firms had been notified.
Chen has also said preliminary technical evidence points towards possible involvement by a North Korean-linked hacking group. However, the attribution remains preliminary and should not be treated as a confirmed identification of the perpetrators. Reporting on Chen’s comments said some IP addresses and VPN patterns appeared consistent with infrastructure previously associated with North Korean cyber operations.
Blockchain monitoring meanwhile showed the attackers moving and converting portions of the stolen assets. Lookonchain reported that most of the stolen funds on Ethereum-compatible networks had subsequently been converted into about 67,982 ETH, worth roughly $183 million at the time of its update.
Bitget said on September 24, 2026 that it would publish a full incident report covering the root cause and corrective measures within 24 hours. As of September 25, withdrawals remained suspended pending completion of the security review.
