Bitget completed the phased restart of withdrawals on 2 October 2026, eight days after attackers moved about $388 million out of the exchange’s hot and warm wallets. The Bitget hack of 24 September is the largest single theft of 2026 so far, and the exchange says customer balances were covered in full by its User Protection Fund rather than passed on to users.
What happened on 24 September
According to Bitget’s incident page, unauthorized transfers began at 18:31 UTC on 24 September across several blockchains. The emergency response was triggered at 19:14 UTC and wallet withdrawal services were shut down and isolated at 21:44 UTC. Bitget says it identified the root cause the next morning, at 08:43 UTC on 25 September, and reported the incident to law enforcement that afternoon.
The first estimate, reported by Bloomberg on 25 September, was $351.6 million. Bitget then raised it to about $387.5 million after adding Zcash and TRON assets that the first count had missed, according to its support announcement. The final verified figure on the incident page is about $388 million, spread across 12 wallet addresses and 11 blockchains. Affected assets include ETH, XRP, USDT, USDC, ZEC, BNB, AVAX, TRX and the tokenized gold XAUt.
How the attackers got in
Bitget says private keys were not compromised and cold storage was untouched. Instead, the attacker used a zero-day vulnerability in a third-party security product to reach internal systems and obtain high-privilege credentials. Forged withdrawal commands were then injected into the wallet backend, where they passed risk controls as if they were normal withdrawals, before the attacker deleted traces of those commands.
Two outside firms, Mandiant (part of Google Cloud) and SlowMist, delivered independent reports on 30 September. Bitget says both attribute the initial access to compromised third-party security products. The vendors have not been named publicly.
CEO Gracy Chen has linked the attack to North Korean hackers, citing on-chain analysis and IP behavior patterns, as reported by BleepingComputer. That attribution comes from the company; as of mid-October no law enforcement agency had publicly confirmed it.
Withdrawals, reserves and the protection fund
Withdrawals came back in four steps, each at 08:00 UTC: bitcoin on 28 September, ETH on 29 September, USDT on 30 September, then all other tokens plus fiat and C2C services on 2 October. Trading and deposits kept running throughout, the exchange said.
- Before the hack, Chen said the User Protection Fund held more than $464 million (Bloomberg, 25 September).
- On 28 September Bitget committed to refill the fund to at least $300 million within a week. It says it passed that mark on 30 September, with 3,705 BTC in the fund.
- Bitget’s proof-of-reserves update of 29 September showed an overall reserve ratio of 131% across 19 assets.
Recovery is slow. Bitget offers a 5% bounty on frozen or recovered funds and uses Bybit’s LazarusBounty platform as a channel. 24/7 Wall St. reported on 3 October that only about $821,000 had been frozen, including roughly $318,000 in stablecoins blocked by Circle and Tether.
Part of a bad month for security
September 2026 was the worst month of the year for crypto thefts. PeckShield counted $766.5 million stolen in 55 major incidents and CertiK $768.4 million across 97 incidents, Cointelegraph reported on 1 October. Earlier in the month, about $320 million in bitcoin was drained from a wallet used by Liquid Network, Bloomberg noted.
What it means for Bitget users
Account balances were not reduced, and the reserve ratio stayed above 100%. The case still shows that the risk on a centralized exchange sits not only in the code you see but in the vendors behind it. Readers can compare security records in our Bitget review and our guide on how to choose a crypto exchange. Holding long-term savings in self-custody removes this particular risk, though it adds others, such as losing your seed phrase.
What to watch
- Whether Bitget names the third-party products involved and publishes a full technical report.
- Any confirmation of the North Korea attribution by investigators or law enforcement.
- The level of the protection fund, which is still below its pre-hack size, and the amounts frozen or recovered on Bitget’s public tracker.