Bitget Hack: What We Know About The $351M Breach

Hackers broke into Bitget's backend systems on September 24, 2026, and moved about $351.6 million out of the exchange's hot and warm wallets. Some of those funds have since been frozen or recovered, though Bitget has not said how much. 

The exchange has paused withdrawals while it investigates, but users can still deposit and trade. 

CEO Gracy Chen says cold storage was not touched and that Bitget's User Protection Fund, worth over $464 million, covers the full loss. It is the largest breach of a centralized exchange so far this year. 

What Happened In The Bitget Hack?

The on-chain record gives a more detailed picture than Bitget's first notice.

The Three Hours After Detection

Bitget says its systems detected unauthorized transfers at 18:31 UTC on Sept. 24. Blockchain data shows the first movement in that same minute:

• 18:31:11 UTC: A wallet labelled "Bitget 6" sent 0.84 ether to a newly created address, a small test transfer that usually precedes a large one.
• 18:58:59 UTC: The same wallet sent 34,751,168 USDT.
• 19:01 UTC: Within 15 seconds, it sent 19,668,851 USDT0 on Arbitrum, 12,852,046 USDC, and 7,130.86 ether.
• 21:23:11 UTC: A final 223.2 ether left, two hours and 52 minutes after detection and seven minutes before Chen published her notice.

A second wallet, "Bitget 35," added 15,362 ether in three transfers. Exchanges run hot wallets on many networks, and shutting each one down safely is not a single switch. Still, the gap between detection and containment was measured in hours.

What Was Stolen

Bitget says the losses were spread across seven chains: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base. Per reports, stolen assets also includes 20.59 million TRX. Blockchain tracker Lookonchain estimates XRP was the largest single asset taken, at 102.93 million tokens worth $157.48 million. Across Ethereum and Arbitrum alone, $133.4 million left Bitget wallets, plus 3,000 Tether Gold (XAUt) tokens worth $12.8 million.

How Did Attackers Get In?

Bitget uses three wallet tiers: online hot wallets for instant transactions, warm wallets that refill them, and offline cold wallets. Only parts of the first two were breached.

Bitget has not named the exact entry point, but it has ruled out a key leak. In a live Q&A, Chen said private keys for all three tiers were not exposed. Instead, attackers got into Bitget's systems and moved funds directly, without using customer withdrawal requests.

In simple terms, attackers got into the backend system that prepares transfers and fed it forged requests. Bitget's own approval process then signed them as normal payouts. The keys stayed safe, but the controls in front of them failed.

Chen said the attack is highly consistent with known patterns of North Korean hacker groups, based on IP behavior and on-chain analysis. Ido Sofer, CEO of key management firm Sodot, has described this pattern as "off-chain hacks that led to on-chain loss of funds," where stolen credentials and API keys give attackers access to move money.

Why Did The Attacker Swap Stablecoins So Fast?

The attacker's choice of assets shows a plan. Tether can freeze USDT and XAUt, and Circle can freeze USDC. No one can freeze ether.

Within six minutes, the attacker pushed the stablecoins through a router contract into Uniswap V3 and V4 pools and swapped them for ether. Pseudonymous analyst DCF GOD noted the buyer was paying up to 5% over spot, which only makes sense if the seller is racing a freeze.

Bitget says some chain foundations have frozen hacker addresses, and Chen said some stolen funds have been recovered, without giving an amount. As of early Friday, roughly 24,590 ether sat in three attacker wallets.

Are Bitget User Funds Safe?

Bitget says yes, and points to three buffers:

• User Protection Fund: about 5,500 BTC in publicly verifiable wallets. Chen valued it at over $464 million, though its dollar value moves with bitcoin's price.
• Proprietary assets: more than $1 billion, according to Chen.
• Proof of reserves: 45 consecutive months of attestations, most recently a 122% reserve ratio for August.

Withdrawals remain frozen with no reopening date, and Chen said Bitget "will not commit to a window we cannot guarantee." The on-chain trading service was also temporarily unavailable on Friday. Bitget has hired an outside security team for an independent forensic review, and its full incident report is due by about 21:30 UTC on September 25.

Bitget Wallet, the separate self-custody app, was not affected. European users are hit hardest, since Bitget has been leaving the EEA under MiCA rules and had told remaining customers to withdraw.

Bitget's exchange token held up better than expected. BGB traded around $1.97 early in Friday's Asian session, roughly 3% to 5% below Thursday's $2.02 to $2.06 range. 

Watch Out For Address Poisoning Scams

Within hours, scammers began sending fake tokens named "ETH," "USDC," and "USDT" from lookalike addresses that differ from the real ones only in the middle. This is called address poisoning. By 22:00 UTC, 14 had appeared against one attacker wallet. Anyone copying addresses from a block explorer should check every character.

Conclusion

Attackers moved $351.6 million out of Bitget after pushing forged transfers through its own backend systems.  Private keys and cold wallets were not compromised, the outflow has stopped, some funds have been frozen or recovered, and a 5,500 BTC protection fund covers the loss. Withdrawals stay frozen until the security review is complete.

Resources

1. Report by Forbes: Bitget Hack Of $351.6 Million Triggers A Withdrawal Freeze
2. Bitget on X: Posts on Sept 25
3. Gracy Chen on X: Posts on Sept 25
4. Report by Blockhead: Bitget Loses $351.6 Million in Hot Wallet Breach, Rules Out Private Key Compromise
5. Report by Bloomingbit: Bitget Says Ethereum, XRP and Other Assets Were Affected by Hack
6. Report by Bitcoin Ethereum News: Bitget probe points to backend breach after $351.6M hack
7. Report by Crypto.news: Bitget probe points to backend breach after $351.6M hack
8. Report by TechFlow: Commissioned a third-party security team for an independent investigation
9. Report by Crypto Times: Bitget Hacked for $351.6M: Withdrawals Frozen as CEO Points to North Korea
10. Report by Finwire: Bitget says $351.6 million affected in wallet breach, pauses withdrawals
11. Report by CryptoTicker: Bitget Hack of $351 Million: What to Check at Your Crypto Exchange Now
12. Report by InvestingLive: Bitget loses $351.6 million to hackers, so why is BGB barely flinching?