Bitget Hack Explained: What Happened to $351.6 Million?
Bitget says unauthorized transfers affected approximately $351.6 million in assets on September 24, 2026. The exchange suspended withdrawals, kept deposits and trading open, and said its cold wallets and customer balances remained secure.[1]
That is the short answer. The more useful answer requires separating what Bitget has confirmed, what outside observers saw on public blockchains, and what remains unknown.
This article reflects information available at 11:00 Jakarta time on September 25, 2026. The investigation was still active at that point, withdrawals were still suspended, and Bitget had not yet published the full incident report it promised within 24 hours.[1][3]
What happened in the Bitget hack?
Bitget said its security systems detected unauthorized transfers at 18:31 UTC on September 24. According to its official notice, the breach affected part of the exchange’s hot- and warm-wallet layers rather than its cold wallets.[1]
A hot wallet stays connected to systems that process routine transactions. That makes it useful for fast deposits and withdrawals, but it also exposes more of the surrounding infrastructure to online attacks. A cold wallet is kept more isolated so that its signing credentials are harder to reach through an internet-connected system.[2]
A warm wallet generally sits between those two approaches. It may have stronger restrictions than a normal hot wallet while remaining accessible enough for exchange operations. The labels can vary between companies, so the important question is how keys, signing systems and withdrawal permissions were actually protected.
Bitget has not yet answered that question in full.
Why did early reports say $183 million while Bitget says $351.6 million?
Independent blockchain observers first reported roughly $183 million moving from addresses labeled as Bitget wallets. Bitget later placed the total amount affected at approximately $351.6 million.[1][2]
Those numbers should not be treated as proof that one side is wrong. Outside researchers can follow transactions on public blockchains, but they may not immediately identify every company-controlled address, every affected network or every asset. Bitget also has access to internal wallet records that outside analysts do not.
The gap still needs an explanation. A complete incident report should identify the affected wallets and networks, show how Bitget calculated the loss, and explain why the company’s estimate was much higher than the early public tally.
How did the stolen assets move?
The transfers crossed several blockchain networks and involved assets including ETH, USDT, USDC, BNB, AVAX and XAUT.[4] This matters because an attacker moving several types of assets across different networks creates a more complicated recovery problem than one transfer on one blockchain.
One of the clearest early transactions involved a newly created wallet using $19.67 million in USDT0 to buy 7,111 ETH in roughly six minutes on Arbitrum. The buyer reportedly paid as much as 5% above the market price through UniswapX and 1inch Fusion.[4]
Paying that much extra suggests speed mattered more than getting a fair price. Stablecoin issuers can sometimes freeze stolen tokens when they identify them. Ether does not have a central issuer with the same freezing authority, so exchanging stablecoins for ETH can make intervention harder.
Blockchain transparency helps investigators follow where funds go. It does not provide a button that automatically reverses a valid transaction. Recovery usually depends on identifying the assets before they are moved again and working with exchanges, token issuers, blockchain teams or law enforcement that can act at a later destination.
Did the hackers steal Bitget’s private keys?
Bitget CEO Gracy Chen said during a live Q&A that the attackers did not obtain the private keys for the exchange’s hot, warm or cold wallets. She described the incident as a breach of Bitget’s systems that allowed funds to be transferred directly, while investigators were still determining exactly which systems were compromised.[3]
The full technical explanation is still missing. Until Bitget releases its root-cause analysis, claims about the exact entry point or software flaw should be treated as preliminary.
Was North Korea responsible for the Bitget hack?
Chen said investigators found IP addresses with VPN choices resembling those used by a North Korean hacking group. She also said the pattern looked similar to previous North Korean operations.[3]
That is a preliminary attribution from Bitget, not a public forensic conclusion from an independent investigator or government agency. VPN services are designed to disguise where internet traffic originates, and an IP-address similarity alone does not explain the entire attack.
The DPRK theory may prove correct. For now, the careful wording is that Bitget suspects a North Korean group.
Are Bitget customer funds safe?
Bitget says customer account balances remain accurate and that the entire estimated loss is covered by its User Protection Fund, which it valued at more than $464 million.[1] On paper, that figure is at least $112.4 million higher than the reported loss.
Customers will receive stronger evidence when withdrawals resume normally, affected balances remain whole, and Bitget publishes enough detail to show how the protection fund will absorb the loss.
A protection fund also answers only part of the question. Readers should want to know:
- Which assets are held in the fund?
- How liquid are those assets?
- Is the fund separate from normal operating money?
- Will the fund be used immediately, or only after recovery efforts finish?
- Will every customer be able to withdraw without a haircut or new restriction?
Bitget said some stolen funds had already been recovered, but Chen did not provide an amount during the Q&A covered by Cointelegraph.[3] That means any calculation of the final net loss would be premature.
Why were withdrawals suspended if customer balances are accurate?
An exchange can display the correct balance while temporarily refusing outgoing transfers. The number in your account is an internal record; a withdrawal requires the exchange’s wallet system to send assets on a blockchain.
Bitget paused withdrawals while it reviewed that system.[1] Deposits and trading remained available, according to the company, but users could not move assets off the platform.[1]
This is exchange custody risk in its simplest form. You may own a claim to the assets shown in your account while the company controls when and how those assets leave. A self-custody wallet changes that relationship because you control the signing keys, although it also makes you responsible for backups, transaction checks and device security.
What should Bitget users do now?
Start with official information. Use Bitget’s website and verified channels rather than links sent through direct messages, replies or unofficial support accounts. Breaking security incidents attract scammers who offer fake recovery forms, fake withdrawal portals and fake customer-service help.
If you have funds on Bitget, check whether withdrawals have officially reopened before making plans around a transfer. A social-media screenshot is not enough. Confirm the status inside the official app or website, then consider a small test withdrawal before moving a larger amount.
Avoid making a rushed custody decision based only on fear. Keeping every asset on an exchange concentrates counterparty risk. Moving everything into self-custody without understanding seed phrases, address verification and backups replaces that risk with personal operational risk.
Ask yourself what the assets are for. Funds used for frequent trading may need different handling from long-term Bitcoin savings. The goal is to know who controls each balance, what can interrupt your access, and whether you can handle the responsibility that comes with the alternative.
What information should we watch next?
The promised incident report is the most important next document. It should explain the root cause, affected systems, wallet boundaries, loss calculation and corrective actions.[1]
Readers should also watch for:
- a confirmed withdrawal-reopening time;
- a final amount stolen and recovered;
- evidence supporting or rejecting the North Korea attribution;
- a clear accounting of the User Protection Fund;
- confirmation that customers can withdraw normally;
- an independent technical review, if Bitget commissions or publishes one.
A quick reopening would be useful, but speed alone should not be the standard. The stronger outcome would be a careful reopening after the vulnerable path has been identified, repaired and tested.
FAQ
How much was stolen in the Bitget hack?
Bitget’s current estimate is approximately $351.6 million.[1] Earlier blockchain-based estimates tracked roughly $183 million in visible movements, so the final incident report needs to explain the difference.[2]
Are Bitget withdrawals working?
Withdrawals were still suspended at the evidence cutoff for this draft. Deposits and trading remained operational, according to Bitget.[1]
Did the hackers compromise Bitget’s cold wallets?
Bitget says its cold wallets remained secure and that the affected area was limited to portions of its hot- and warm-wallet infrastructure.[1] This remains a company claim pending fuller forensic reporting.
Will Bitget customers lose money?
Bitget says its User Protection Fund will cover the full reported loss and that customer balances are accurate.[1] The practical test will come when withdrawals resume and users can move their assets without losses or new restrictions.
Was the Bitget hack carried out by North Korea?
Bitget suspects a DPRK-linked group based on preliminary technical clues, including IP addresses associated with VPN choices seen in previous attacks.[3] Public evidence establishing responsibility had not been released at the time of this draft.
What this incident teaches us
The Bitget hack is still developing, but one lesson is already clear: an account balance and direct control of an asset are different things.
Bitget may cover every dollar. Its protection fund may work exactly as promised. Investigators may recover more of the stolen assets. Those outcomes would be good for customers and for the wider market.
Users still had to wait because the exchange controlled withdrawals. That is the tradeoff at the center of custodial platforms. They offer convenience, liquidity and support, while asking you to trust their internal systems and response plans.
Choose custody based on what you understand and what you can manage safely. Exchange risk is real. So are lost seed phrases, malicious wallet software and mistaken self-custody transactions. The sensible answer depends on your use case, but it should always begin with knowing who holds the keys and who can stop the transfer.
Disclaimer: This article is for general informational and educational purposes only. It does not provide financial, investment, legal or tax advice. Cryptocurrency is volatile and involves substantial risk. Conduct your own research and consider qualified professional advice before making financial decisions.
Sources
[1] https://www.bitget.com/support/articles/12560603896024 — [SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026
[2] https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe — Crypto exchange Bitget says $352 million affected in a hack
[3] https://cointelegraph.com/news/bitget-ceo-suspects-north-korea-behind-352m-hack-citing-ip-clues — Bitget CEO suspects North Korea behind $352M hack
[4] https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets — Bitget Hacked as $350 Million Vanishes From Crypto Exchange Wallets
Related reading
Continue with these related Proof of Tech guides: