Crypto exchange Bitget lost $351.6 million in a hack on Thursday, September 25, 2026, at 18:31 UTC. During a live Q&A session on X, CEO Gracy Chen stated that initial investigations uncovered IP traces consistent with VPNs commonly chosen by North Korean hacking groups.
The final loss grew from initial on-chain reports that had only detected $183 million. Chen explained that the exploit continued to expand beyond initial activity on the Ethereum network to reach $351.6 million. The updated theft figure makes the incident the largest crypto hack of 2026, surpassing the $320 million Liquid Network breach in early September.
How Did Hackers Breach Without Keys?
The biggest question centers on the exploit vector. Chen emphasized that the incident was purely an external attack, not an insider job. No cold wallet private keys were compromised, and the attackers did not forge user withdrawal requests. The hackers reportedly transferred funds directly from hot and warm wallets, while cold storage was confirmed to remain secure.
Findings from Arkham Intelligence analyst Emmett Gallic showed assets being consolidated from three Bitget hot wallets and one cold wallet into a single address. The stolen tokens included ETH, XRP, USDT, USDC, AVAX, BNB, and USDT0. The largest concentration of losses occurred on the Ethereum network, followed by XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum.
Trading Active, Withdrawals Suspended
Bitget has temporarily suspended withdrawals, though deposit and trading features continue to operate normally. Chen assured that all losses are fully covered by the User Protection Fund, which currently holds over $464 million in assets. The exchange’s native token, BGB, dropped following the incident.
The exchange’s security team has flagged the attacker’s addresses, contacted law enforcement, and partnered with on-chain analytics firms. A portion of the funds has reportedly been recovered, though the exact amount has not been disclosed. A comprehensive incident report detailing the root-cause analysis was promised within 24 hours.
The suspicion directed toward North Korea adds to the group’s long track record of crypto exploits. They were previously linked to $2.02 billion in crypto thefts throughout 2025, including a $1.5 billion breach of Bybit. While customer funds remain protected, how the perpetrators managed to bypass security without touching private keys remains the key vulnerability awaiting explanation.
Reported by Cointelegraph.
Previously: Bitget Wallets Drained of $183 Million in One Hour - Attacker Paid 5% Above Market Rate for ETH
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
