Crypto exchange Bitget currently estimates that approximately $388 million in assets were transferred to attacker-controlled addresses during its September 24 security breach, making it one of the largest crypto security incidents of 2026.
According to security researchers, September became the highest-loss month of 2026 for crypto hacks, with reported gross losses ranging from approximately $747 million to $768 million, depending on the dataset and methodology. The Bitget breach and the Liquid Network exploit accounted for most of the month's reported losses.
For a broader look at the quarter's biggest security incidents, attack methods and recovery efforts, read our Q3 2026 Crypto Hacks Report.
Bitget's subsequent investigation identified a vulnerability in a third-party security product that allowed the attacker to obtain privileged internal credentials and submit fraudulent withdrawal instructions through the exchange's wallet infrastructure. The attack exploited weaknesses in the authorization process rather than exposing the exchange's private keys.
To understand what happened firsthand, we watched Bitget CEO Gracy Chen’s livestream on X following the incident. Quotes from Gracy Chen in this article are taken from this livestream. The full stream is available here:
What Happened to Bitget?
TL;DR: Bitget detected unauthorized transfers from its hot and warm wallet infrastructure on September 24, 2026. The exchange suspended withdrawals, flagged attacker-linked addresses and began working with law enforcement and security partners, while its cold wallets remained unaffected.
Unauthorized transfers began at approximately 18:31 UTC on September 24, 2026. Bitget's reconciliation systems detected discrepancies at around 19:05 UTC, triggering the exchange's emergency response procedures.
Bitget says its security team activated emergency response procedures within minutes, identified and flagged attacker-linked addresses, suspended withdrawals and contacted law enforcement and blockchain security firms.
Speaking during a livestream after the incident, Chen explained that Bitget uses a three-layer wallet architecture: hot, warm and cold.
She said the compromised infrastructure involved the hot layer and part of the warm layer, while the cold-wallet layer, where the majority of platform and user funds are held, remained unaffected.
The distinction between the wallet layers matters. Hot wallets are connected to operational systems and designed to process transactions quickly. Warm wallets provide an intermediate operational layer, while cold wallets keep the majority of reserves away from internet-connected infrastructure.
The breach therefore did not reach Bitget's deepest storage layer. But attackers were still able to manipulate infrastructure controlling hundreds of millions of dollars in operational assets.
How Did the Bitget Hack Work?
TL;DR: Bitget says its private keys were not stolen. Preliminary findings instead suggest attackers compromised a backend system, manipulated transaction data and used the exchange's normal authorization process to move funds.
The most significant technical finding so far is what apparently did not happen: Bitget says the attackers did not steal its private keys.
Chen said during the livestream that investigators also found no indication that the attackers simply forged user information and submitted ordinary customer withdrawal requests.
Instead, they breached Bitget's systems and initiated transfers through infrastructure operated by the exchange.
Bitget's subsequent investigation provided a clearer picture of the attack.
According to the exchange, the attacker exploited a vulnerability in a third-party security product to obtain privileged internal credentials. These credentials were then used to submit fraudulent withdrawal instructions through Bitget's wallet infrastructure.
In this case, the private keys may have remained secure while another compromised system manipulated what those keys were being asked to sign.
Chen summarized one of the investigation's clearest findings:
"Private key compromise has been ruled out."
Bitget says the immediate vulnerability has been contained and no further unauthorized transfers are currently possible. However, investigators are still determining exactly how the attackers entered the affected system.
What Was Stolen?
Bitget currently estimates that approximately $388 million in assets were transferred during the incident.
According to the latest reconciliation, the transfers involved 12 wallet addresses associated with Bitget's hot or warm wallet infrastructure across 11 blockchains.
The affected networks identified to date are Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand and Celestia.
Affected assets identified so far include XRP, ETH, USDT, ZEC, ATOM, USDC, USD0, XAUt, BNB, AVAX, TRX, ALGO and TIA.
Bitget initially reported approximately $351.6 million in affected assets. The estimate subsequently increased as additional transactions and assets associated with the original September 24 incident were identified and classified.
The exchange stresses that the revised figure does not represent another wave of unauthorized transfers or a separate security incident.
What Is Bitget Doing After the Hack?
Chen said during the livestream that Bitget had mobilized its security, engineering and product teams immediately after detecting the unauthorized transfers and had already stopped further suspicious movement by the time she addressed users.
"We have our full security, technology and product teams activated now. We have identified that there are no more transfers."
The exchange is also strengthening withdrawal verification, anomaly monitoring and its assessment of third-party security products.
The next major priority is tracing the stolen assets and recovering as much as possible. Bitget is working with law enforcement agencies, financial intelligence units, on-chain security specialists, exchanges, blockchain projects and other industry participants.
Chen said during the initial response that the stolen assets were already being followed in real time:
"The money that was stolen today is being tracked right now. Our internal analytics and security teams, together with external partners and law enforcement, are following the movement of the funds. The money is traceable."
The exchange has also launched a Recovery Bounty Program. Eligible voluntary actions that directly result in affected funds being frozen or recovered may qualify for a bounty equal to 5% of the amount frozen or recovered, subject to the program's terms.
Bitget has also published identified attacker addresses and tracing information to support broader industry collaboration.
Why Recovering Stolen Funds Is Difficult
Following stolen crypto is one thing. Actually stopping it is considerably harder.
Chen explained during the livestream that sophisticated attackers can disperse assets across large numbers of addresses almost immediately and then move them through different services and networks.
"As soon as they steal the money, they distribute it into hundreds and thousands of addresses. They can use mixing, convert into cash or privacy currencies such as XMR, use cross-chain bridges, and then look for ways to off-ramp."
Major centralized exchanges are generally harder places to cash out stolen assets because they enforce KYC and cooperate with investigators and other exchanges.
Attackers can therefore look for infrastructure where transactions are harder to stop or where no single party has the power to freeze them.
Chen also discussed North Korea-linked groups such as Lazarus during the initial livestream as an example of sophisticated operations capable of both stealing and laundering crypto:
"They are very sophisticated hackers. They are very smart not only in stealing the money, but also in laundering the money. They use different methods and different architectures to move the funds."
The Bitget case has now provided a particularly clear example of the broader recovery problem.
What Happened to the Stolen Funds?
The days after the attack have shown just how differently crypto infrastructure can respond when stolen assets begin moving across the ecosystem.
Some funds were stopped relatively quickly. Circle and Tether blacklisted a wallet linked to the Bitget attacker, freezing approximately 99,990 USDC and 218,023 USDT, or roughly $318,000 combined.
That represented only a fraction of the total loss.
Much of the stolen value was held in assets such as ETH and XRP, where there is no centralized stablecoin issuer capable of simply blacklisting a wallet balance.
The attacker also began converting and moving assets across networks.
Subsequent blockchain investigations have provided a more detailed picture of the laundering activity, including the movement of stolen assets through cross-chain infrastructure and services designed to obscure transaction trails.
However, identifying the destination of stolen funds does not necessarily mean those assets can be frozen or recovered. The outcome depends on the type of asset, the infrastructure involved and the willingness or technical ability of intermediaries to intervene.
One of the most controversial routes has been THORChain, where Bitget-linked funds continued to be swapped despite the attacker's addresses being publicly identified.
Why THORChain Wouldn't Block the Hacker
Bitget CEO Gracy Chen publicly called on THORChain to prevent addresses associated with the attacker from using the protocol.
THORChain rejected the request for selective blacklisting.
The protocol's position is that its emergency halt mechanism exists to protect THORChain itself and is not designed to selectively block a particular wallet or transaction. As permissionless infrastructure, THORChain argues that it does not censor individual users.
That distinction quickly became controversial.
Critics pointed out that THORChain does have mechanisms allowing node operators to halt parts of the network. The protocol used emergency controls following its own $10.7 million exploit earlier in 2026, although THORChain maintains that even then it did not blacklist individual attacker addresses.
Meanwhile, Bitget-linked funds continued moving through the protocol.
On September 28, one wallet linked to the attack completed 27 swaps through THORChain, converting approximately 2,390 ETH into 75.2 BTC, worth around $6.3 million at the time.
Security researchers have tracked additional Bitget-linked assets moving through the protocol.
The dispute has therefore grown beyond the Bitget hack itself.
It raises a much older question for crypto: when stolen funds are clearly identified, should permissionless infrastructure remain neutral?
ChangeNOW's Editorial Advisor Xena Kash sees the disagreement as part of a broader conflict between the original principles of crypto and the security demands of a much larger industry:
“The immediate issue is THORChain's architecture itself: its freeze mechanism is not designed to stop individual transactions. But the conflict goes much deeper. What we're seeing is a fundamental tension between permissionless, privacy-oriented infrastructure rooted in crypto's original values and the regulatory environment the industry operates in today.
In many ways, this is a direct collision between DeFi and CeFi. Decentralized protocols such as THORChain still have considerably more freedom, partly because they face less regulatory pressure.
But the reality is that crypto hacks have become an increasingly serious threat to users. I believe DeFi protocols will eventually have to develop better tools for responding to illicit activity and become more open to cooperation with authorities. Without that cooperation, protecting users across the crypto ecosystem will become increasingly difficult.”
THORChain was not the only cross-chain service the attackers attempted to use. Another protocol took a very different approach.
NEAR Intents Takes the Opposite Approach
NEAR Intents said attackers attempted to route more than $50 million in Bitget-linked assets through its cross-chain infrastructure.
Its response was markedly different.
According to NEAR Intents, its SHIELD system detected and rejected most of the attempted transfers. Around $503,000 was stopped mid-transaction and remains restricted pending legal and recovery proceedings, while approximately $166,000 passed through the service.
The $50 million figure therefore does not mean NEAR froze or recovered $50 million. It represents attempted transfers, most of which were rejected and subsequently routed elsewhere.
The contrast makes the Bitget case unusually revealing.
Circle and Tether exercised issuer-level freezing powers. NEAR Intents chose to screen and reject suspicious swaps. THORChain chose not to selectively censor identified addresses.
The same stolen funds effectively encountered three different answers to one question: how much intervention should crypto infrastructure allow when the assets are known to be stolen?
Are Bitget User Funds Safe?
Bitget says user account balances remain unaffected.
The exchange says the temporary withdrawal pause was implemented as a security measure while its teams secured and validated withdrawal infrastructure, rather than because of insufficient user assets.
Bitget's Protection Fund covers the financial impact of the platform-wide incident.
The Protection Fund is separate from the exchange's Proof of Reserves: Proof of Reserves provides transparency into assets held by the platform relative to user balances, while the Protection Fund serves as an additional financial protection mechanism for eligible platform-wide security incidents.
Bitget completed its phased withdrawal restoration on October 2, 2026, following additional security checks across its wallet infrastructure.
BTC withdrawals resumed on September 28, followed by ETH on September 29 and USDT on September 30. Withdrawals for other supported cryptocurrencies, along with fiat and P2P services, were restored on October 2.
Bitget maintains that user account balances were not affected by the incident and that the financial impact is covered by its Protection Fund. The exchange has also reported strengthening its withdrawal authorization procedures, anomaly detection systems and third-party security assessments.
Asset tracing and recovery efforts remain ongoing.
What Should Bitget Users Do Now?
For users whose account balances remain correct, the biggest immediate risk may no longer be the original exploit itself, but criminals attempting to take advantage of the confusion around it.
Users should check updates only through Bitget's official website, app and verified social accounts.
A major exchange hack creates an obvious opportunity for phishing campaigns built around fake withdrawal reopening notices, “compensation” forms and supposed fund-recovery services.
No legitimate support representative should need a user's seed phrase or private key.
Users should also review their Bitget login history, connected devices, two-factor authentication and API access. Anyone seeing activity they do not recognize should secure the account and contact Bitget through its official support channels.
Most importantly, nobody should transfer crypto to a third party claiming they can bypass withdrawal restrictions, accelerate reimbursement or recover funds on a user's behalf.
Was North Korea Behind the Bitget Hack?
Blockchain analytics firm Chainalysis has attributed the Bitget theft to North Korean threat actors, adding the incident to a growing list of major cryptocurrency attacks linked to the DPRK.
In its October 1 investigation, Chainalysis examined the movement of stolen assets across multiple blockchains and laundering services. The firm reported that the Bitget incident pushed the total value of cryptocurrency stolen by DPRK-linked actors in 2026 above $1 billion.
Bitget has taken a more cautious position in its own public communications, emphasizing that attribution should be supported by independent forensic findings. Chainalysis's assessment should therefore be distinguished from the exchange's official conclusions.
During the initial response, Bitget CEO Gracy Chen had already discussed indicators suggesting possible DPRK involvement, including similarities in VPN infrastructure associated with previously identified North Korean operations.
On-chain analyst Specter separately reported links between XRP stolen from Bitget and funds associated with the earlier AFX incident, which had been attributed to TraderTraitor, a Lazarus-linked operation.
While these early observations were not sufficient to establish attribution independently, Chainalysis subsequently published a more definitive assessment linking the theft to DPRK-associated actors.
The Recovery Effort Is Now Bigger Than Bitget
The initial Bitget hack took place within a matter of hours. Recovering the stolen assets could take considerably longer.
The response has already spread across centralized exchanges, stablecoin issuers, blockchain projects, cross-chain protocols, analytics firms, security researchers and law enforcement.
For ChangeNOW, the approach is straightforward. If funds linked to the Bitget attack reach our infrastructure and are identified by our AML systems, we will stop the transaction, preserve the relevant information and do everything we can to support Bitget, investigators and law enforcement.
This is not theoretical. ChangeNOW has worked with victims, exchanges, investigators and law enforcement across numerous recovery cases and has helped return more than $50 million in stolen or illicitly obtained crypto over nine years.
The Bitget case also demonstrates why recovery becomes much harder once stolen assets begin moving across different parts of the crypto ecosystem.
A centralized issuer may be able to freeze a token. A compliance-focused service may reject a transaction. A permissionless protocol may conclude that doing either would violate the way it was designed to operate.
Those differences are no longer an abstract debate about decentralization.
When hundreds of millions of dollars in stolen crypto are moving across chains, they can determine whether the money stops or keeps moving.
