The short version
- About $387.5 million left Bitget's hot and warm wallets on 24 September 2026 (UTC), the largest crypto theft of the year so far.
- The way in was a zero-day flaw in a third-party security product. The earliest malicious activity dates to 31 August.
- Bitget says customers are covered by its protection fund, and private keys and cold wallets were not touched.
- Bitget points to North Korean hackers, based on IP patterns and on-chain links. No government has confirmed this yet.
- Only about $1.1 million has been frozen. Laundering began in late October.
At 18:31 UTC on 24 September, two tiny transfers left Bitget's hot wallets: a small amount of TRX on Tron and a fraction of an ETH on Ethereum. Both sat below the exchange's risk-control threshold. No alarm went off.
That was the point. According to Bitget chief executive Gracy Chen, the attacker was testing whether the system would notice. It didn't. About half an hour later the large transfers began, and by the time Bitget's reconciliation system flagged the gap, the first big withdrawal had already been out for seven minutes.
By the end of the night, assets worth roughly $387.5 million, spread across 11 blockchains and 13 tokens, were sitting in addresses controlled by the attacker.
01 · TIMELINETwenty-five days in, three hours out
The theft itself was fast. The setup was slow. Forensic work by SlowMist and Google-owned Mandiant shows the attacker had a foothold inside Bitget's infrastructure for more than three weeks before a single coin moved. Tap any step for detail.
- Zero-day hits a third-party security productShow detail +
SlowMist traced the earliest logged malicious activity to a service on a node of "Product A". The attacker ran a hidden script under that service, read a database password from an environment variable and connected to the database.
- The same hidden-script activity spreads to more nodesShow detail +
Similar activity later appeared on a second node and then a third. Mandiant found the attacker had reached two third-party security appliances and planted a web shell on one of them, with a command-and-control link back out.
- A hijacked employee identityShow detail +
Using an internal employee's identity, the attacker logged into the management platform of "Product B", tried command injection three times, uploaded malicious program files and attempted to change server configuration.
- Custom theft tool starts runningShow detail +
A purpose-built tool, later recovered by SlowMist from deleted files, began forging risk-control parameters, building withdrawal requests and calling the wallet system's withdrawal process.
- The test: two dust transfersShow detail +
Small amounts of TRX and ETH went out, 11 seconds apart. Both stayed under Bitget's risk threshold and triggered no alerts. Reports differ on the exact amounts.
- The big transfers beginShow detail +
Between 18:58 and 20:09, 17 transactions across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism and Avalanche moved about $361 million, according to The Block.
- Reconciliation flags the gapShow detail +
Seven minutes after the first large transfer, Bitget's reconciliation system spotted a major discrepancy. The risk system then blocked user withdrawals across the platform. Chen says her team also moved remaining hot and warm wallet funds into cold storage mid-attack.
- Last outflow, then a failed Bitcoin grabShow detail +
On-chain transfers ended after 2 hours 52 minutes. The attacker then tried to edit withdrawal records directly in the wallet database to push out Bitcoin. Two forged BTC orders entered processing but returned errors.
- Withdrawals reopenShow detail +
BTC withdrawals resumed and processed more than 3,000 BTC in the first hour. ETH withdrawals followed on 29 September.
- Bitget confirms the zero-dayShow detail +
Citing SlowMist's findings, Bitget publicly confirmed "malicious activity involving third-party security products, including a zero-day vulnerability", and disabled the affected functionality until a fix is complete.
- The money starts movingShow detail +
$19.48 million, mostly in Bitcoin, moved to new wallets across 52 transactions. Over $240 million is still held by the attacker, Finbold reported.
An incident like this scale is very serious. But serious doesn't mean existential.Gracy Chen, Bitget CEO, to The Block
02 · THE BREACHHow a security product became the way in
The detail that unsettles security teams most is the entry point. The attacker did not phish a hot-wallet signer or steal a private key. They broke into software that Bitget ran to protect itself.
SlowMist's progress report describes two third-party security products, labelled only as "Product A" and "Product B", plus a wallet application host. Bitget has notified the vendor but has not named it, and neither has any investigator.
Reconstructed from SlowMist and Mandiant findings as reported by The Hacker News and Cointelegraph. SlowMist says it is still examining how the attacker moved between systems.
Once the attacker reached the production wallet job server, they could insert withdrawal commands that the backend treated as genuine. Chen told Cointelegraph the breach gave the attacker "high-level internal credentials". The custom tool forged the risk-control parameters that would normally stop a large outflow.
Then came what Chen called "the trickiest part": the attacker deleted the traces of those commands, which is why the investigation is still filling in gaps a month later.
What was taken
Thirteen assets on eleven networks:
03 · ATTRIBUTION"Still the same group of people"
Bitget says IP behaviour and on-chain analysis point to North Korean threat actors. Chen said investigators found IP addresses linked to VPN services known to be used by North Korean hackers, and that the pattern of the attack matched earlier incidents blamed on the same groups. Blockchain analytics firms Elliptic and TRM Labs reportedly found wallet overlaps with the laundering of proceeds from previous hacks.
Asked by The Block who was behind it, Chen said, "It's still the same group of people that we suspect," but declined to name them before the formal incident report. As of this update, no government agency has published an attribution.
04 · CUSTOMERSWho pays for $387.5 million?
Not customers, according to Bitget. The exchange's user protection fund, worth about $465 million on 25 September, absorbs the loss. Chen said the fund would be refilled to at least $300 million from corporate reserves, which stood above $1.4 billion in an audit dated 31 August. Later reports say the fund now holds more than $300 million again.
Withdrawals were frozen for several days. When Bitcoin withdrawals reopened on 28 September, more than 3,000 BTC went out in the first hour. Chen later said the exchange saw an early net inflow once withdrawals were back.
Permissionless doesn't mean neutral.Gracy Chen, on the Unchained podcast, after THORChain declined her request to act on the stolen funds
05 · FOLLOW THE MONEYFrozen, moving, and mostly gone
Recovery has been slow. Stablecoin issuers can freeze tokens they control, and some did. Most of the haul, though, is in native assets like ETH, XRP and ZEC that no single company can lock.
| Date | Event | Amount |
|---|---|---|
| 24 Sept | Moved to attacker addresses across 11 chains | $387.5M |
| 30 Sept | Frozen so far (Unchained) | ~$0.63M |
| 1 Oct | Frozen by Circle, Tether and NEAR Intents | ~$1.1M |
| 21–24 Oct | Moved to new wallets, 52 transactions, mostly BTC | $19.48M |
| 24 Oct | Still held by the attacker (Finbold) | >$240M |
THORChain, a cross-chain swap protocol often used to move stolen funds between networks, declined Chen's request to intervene. Chen has said she is "not very optimistic" about getting the money back, pointing to how little was recovered after Bybit's $1.5 billion hack in 2025.
06 · CONTEXTWhere Bitget ranks among the biggest heists
Bitget's loss is the largest of 2026 so far, but it is about a quarter of the record set by Bybit in February 2025.
Largest centralized-exchange and bridge thefts
USD value at time of theft, approximate · millions
Bitget's attribution to North Korea is the exchange's own and has not been officially confirmed, so it is not marked as such.
07 · WHAT'S NEXTThe questions still open
Bitget has promised a formal incident report with Mandiant and SlowMist. Three questions matter most. Which vendor shipped the vulnerable product, and are other exchanges running it? How did a single forged withdrawal path bypass risk controls for over an hour? And why did a $361 million outflow take seven minutes to register at all?
For the wider industry, the lesson is uncomfortable. Exchanges have spent years hardening key management and cold storage, and Bitget says both held. The weak point this time was the software meant to watch everything else.
08 · FAQYour questions, answered
Did Bitget customers lose money?
Bitget says no. Losses are covered by its user protection fund, which is being topped back up from company reserves. Withdrawals were paused for several days and have since reopened.
Were Bitget's private keys or cold wallets compromised?
No, according to Bitget. The attacker made the wallet system send funds by forging withdrawal orders. They did not steal signing keys.
Which security vendor had the zero-day?
It has not been named. Investigators refer to the products only as "Product A" and "Product B". Bitget notified the vendor and disabled the affected functionality.
Was it really North Korea?
Bitget says IP patterns and on-chain links point that way, and analytics firms found wallet overlaps with earlier hacks. No government has formally attributed the attack so far.
Will the stolen funds be recovered?
Probably only a small share. About $1.1 million has been frozen, and the attacker has begun moving funds to new wallets. Bitget's CEO has said she is not optimistic.
What can I do to protect funds I keep on exchanges?
Turn on withdrawal address allow-lists and hardware-key two-factor authentication, keep only what you trade on an exchange, and check whether your exchange publishes proof of reserves and runs a protection fund.
09 · SOURCESReporting this story draws on
- The Hacker News: Bitget confirms third-party zero-day behind $387.5M theft
- The Block: Attacker tested risk controls with small transfers, CEO says
- Cointelegraph: SlowMist investigation into the Bitget zero-day
- BleepingComputer: Bitget hacked via zero-day in third-party security products
- Unchained: How Bitget is chasing $388 million in stolen funds
- Expert Insights: North Korean hackers suspected in Bitget theft
- Pluang / Finbold: Bitget hacker moves $19.48M
- PYMNTS: Bitget suffers year's largest crypto hack