All incidents · Sep 24, 2026
Unauthorized transfers from Bitget hot and warm wallets
BitgetExchangeContainedEthereum, XRP Ledger, Zcash, Tron, Arbitrum, Optimism, Base, BSC, Avalanche, Algorand, Celestia
On September 24, 2026, some Bitget hot wallets and warm wallets were transferred without authorization. The official final tally was about $388 million. Cold wallets and private keys were not affected. User balances were not changed. Withdrawals resumed in batches from September 28, and were fully restored on October 2. Chainalysis said it was linked to North Korea.
Other figures
- Loss351.6million USDBitget: preliminary estimate that day · as of Sep 24, 2026
- Loss387.5million USDBitget: on-chain check the next day · as of Sep 25, 2026
Sequence
Newest first · UTC
Oct 132026 · Tue
The official page put the final tally at about $388 million
Revision · Bitget
This update of the incident page put the final verified amount at about $388 million, across 12 addresses, all of them hot wallets and warm wallets. The assets were XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, TRX, ALGO, and TIA, spread across 11 chains. User balances were still written as unchanged. The financial impact was borne by the protection fund. The page header said the fund had been restored, as promised, to more than $300 million. It was shown as more than $314 million, holding 3,705 BTC. The Q&A on the same page still said 5,500 BTC and more than $464 million. Freezes and recovery were still going. The page said the amounts kept changing and did not give a fixed figure.
Following final verification, approximately $388M in assets was transferred out, involving 12 wallet addresses, all of which were hot wallets and warm wallets.
Oct 22026 · Fri
Chainalysis said North Korea took it
Statement · Chainalysis · @chainalysis
In the post, Chainalysis wrote the September 24 Bitget theft as North Korea taking $387 million, and said laundering started quickly. The page records this as the security firm's account.
What happens when North Korea steals $387M in crypto and starts laundering it at machine speed? We put that question to the test after the September 24 Bitget theft.
Withdrawals of the remaining coins resumed, and the phased plan ended
Confirmation · Bitget
The official page said that from 08:00 UTC on October 2, withdrawals resumed for coins other than BTC, ETH, and USDT, and for fiat and P2P. The phased plan that began on September 28 ended here. It was not by account tier. The earlier steps were BTC on the Bitcoin network at 08:00 UTC on September 28, and ETH on Ethereum, BSC, Arbitrum, Base, and Optimism at 08:00 on September 29.
Supported coins other than BTC, ETH, and USDT, as well as fiat and P2P services, have resumed as scheduled, marking the full completion of the phased withdrawal resumption plan.
Sep 302026 · Wed
USDT withdrawals resumed, and the two firms published investigation reports
Confirmation · Bitget
The support notice said USDT withdrawals were open on Ethereum, BSC, Solana, and Tron. The incident page also recorded two things on September 30. Mandiant (Google Cloud) and SlowMist published investigation reports. The conclusions broadly matched the path already made public. After a third-party security product was compromised, the other side entered the exchange's wallet environment. After control was complete, there were no new unauthorized transfers. The same line said the protection fund had been restored to more than $300 million. The support notice itself only confirmed that USDT withdrawals had resumed.
Bitget has now opened the withdrawal service for USDT on the Ethereum, BSC, Solana, and Tron networks.
Sep 282026 · Mon
The company explained the cause, and part of the bitcoin withdrawals had been processed
Technical · Gracy Chen · @GracyBitget
Gracy Chen relayed that day's livestream. The other side used a flaw in a third-party product to take internal credentials, then sent withdrawal instructions that bypassed risk controls. Private keys were not leaked. Cold wallets were not affected. As of 17:00 Beijing time (09:00 UTC), the Bitcoin network and BSC had processed 9,585 withdrawals, totaling 4,098.036 BTC. She wrote that the loss was fully covered by the protection fund, that users were not affected, and that the fund would be restored with company funds to more than $300 million within a week. This is a coverage claim. The page does not give an amount already returned.
The attacker exploited vulnerabilities from third-party products to steal internal credentials, then used those credentials to send fraudulent withdrawal commands that bypassed our risk controls. Private keys were not compromised, and cold wallets were not affected.
Sep 252026 · Fri
The loss was revised to about $387.5 million
Revision · Gracy Chen · @GracyBitget
Gracy Chen said on-chain tracing confirmed $387.5 million had been transferred to the other side's addresses. That was higher than the previous day's $351.6 million. The extra amount came from counting transfers on Zcash and TRON. She wrote that this was more complete accounting, and that there were no new unauthorized transfers after that. Mandiant and SlowMist were still investigating. The bounty is 5% of amounts frozen or recovered with active help. She said the withdrawal plan would be published before 04:00 UTC on September 26.
Onchain tracing has confirmed $387.5M transferred to attacker addresses — revised up from $351.6M. The higher figure reflects a more complete accounting of transfers during the incident, adding Zcash and TRON assets. To be clear: this is not additional theft.
Sep 242026 · Thu
The chief executive gave a preliminary estimate of about $351.6 million
Confirmation · Gracy Chen · @GracyBitget
Gracy Chen posted a security notice and wrote the discovery time as 18:31 UTC. The preliminary estimate was about $351.6 million. The scope was some hot wallets and warm wallets. Cold wallets were not affected. Withdrawals were paused. Deposits and trading continued. She wrote that user balances were not changed. The user protection fund was then more than $464 million, and this loss was within the fund's coverage. The notice said the method would not be guessed before the investigation finished. Law enforcement and on-chain security firms had been notified. A later official page wrote the start of the transfers as 18:31 and detection of the anomaly as 19:05. Both are kept.
Estimated funds affected: approximately $351.6 million
Reconciliation stopped withdrawals across the site
Halt · Bitget
The same page puts detection of the mismatch at 19:05 UTC. After reconciliation did not match, risk controls automatically blocked withdrawals across the site.
At 19:05 UTC, Bitget's reconciliation system detected a discrepancy in fund verification, and the risk control system immediately and automatically intercepted withdrawal requests across the platform.
Some hot and warm wallets were transferred without authorization
Technical · Bitget
The official page updated on October 13 puts the first unauthorized transfer at 18:31 UTC. It came from some hot wallets and warm wallets.
On September 24, 2026, at 18:31 UTC, the attacker initiated the first unauthorized transfers from certain hot wallets and warm wallets.