At 18:31 UTC on September 24, 2026, Bitget’s security systems detected abnormal transactions from several hot wallets. The exchange subsequently suspended withdrawals to review its systems, while reassuring users that account balances remained safe.

Bitget CEO Gracy Chen quickly posted a security notice and hosted a live Q&A session on X to provide updates on the situation. According to Bitget, the total value of affected assets was approximately $351.6 million.

Incident Details

Bitget stated that the incident affected only a portion of its hot and warm wallets. The cold wallet system, where the vast majority of the exchange’s assets are stored, remains secure. CEO Chen also affirmed that the attacker did not obtain private keys to the wallet systems. According to Bitget’s CEO, the hacker breached the system to transfer funds directly, rather than forging user withdrawal requests.

The exchange committed to safeguarding customer interests through its User Protection Fund valued at over $464 million. This fund exceeds the $351.6 million in losses reported by Bitget.

Deposits and trading on Bitget continued to operate normally during the incident. Only withdrawals were suspended to allow the technical team to investigate the vulnerability, trace fund flows, and address associated addresses.

Hacker Swaps Most Assets into ETH

Data from Lookonchain indicates that the hacker quickly converted the majority of assets stolen across EVM chains into 67,982 ETH, worth approximately $183 million at the time.

This amount of ETH resulted from the hacker swapping other assets, rather than being ETH stolen directly from Bitget. Converting tokens into ETH consolidates the assets into a highly liquid asset while adding complexity to tracing and freezing efforts.

In a subsequent update, Lookonchain detailed the portfolio of stolen assets as follows:

  • 102.93 million XRP, worth approximately $157.48 million.
  • 31,890 ETH, worth approximately $85.75 million.
  • 34.75 million USDT.
  • 21.05 million USDC.
  • 19.67 million USDT0.
  • Along with several other assets including XAUt, BNB, AVAX, and TRX.

The total value of this portfolio was estimated by Lookonchain at approximately $356.85 million.

During the Q&A session, Gracy Chen revealed that the investigation team identified several IP addresses showing signs of links to VPN services previously used by North Korean hacker groups. She noted that the attack pattern bore similarities to prior incidents and dismissed the possibility that this was an inside job at Bitget.

This information raised suspicions that North Korean cyber groups, including the Lazarus Group, might be connected to the incident. However, Bitget has not formally confirmed the identity of the entity behind the attack.

Regarding the entry vector, some reports suggest the hacker may have tampered with the wallet service’s backend system to generate unauthorized transactions. Bitget is continuing its review to pinpoint the compromised system and determine how the hacker accessed the exchange’s infrastructure.

Bitget Says Part of Funds Recovered

Gracy Chen stated that Bitget has recovered a portion of the stolen assets, though she did not disclose the specific amount. The exchange is coordinating with blockchain platforms, security partners, and law enforcement authorities to trace the remaining funds.

The Bitget hack marks one of the most severe incidents in the crypto market in 2026. Further developments will depend on asset recovery efforts, progress toward resuming withdrawals, and Bitget’s official investigation report.