Bitget, a centralized cryptocurrency exchange serving over 150 million users, confirmed on September 24, 2026 that attackers drained approximately $351.6 million from its hot and warm wallet infrastructure. The breach, detected at 18:31 UTC, represents the largest single crypto exchange theft of ...
"User funds are safe. The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million." — Gracy Chen, CEO, Bitget
Bitget, a centralized cryptocurrency exchange serving over 150 million users, confirmed on September 24, 2026 that attackers drained approximately $351.6 million from its hot and warm wallet infrastructure. The breach, detected at 18:31 UTC, represents the largest single crypto exchange theft of 2026, surpassing the Liquid Network's $320 million exploit in early September. Withdrawals remain suspended. Trading and deposits continue to operate.
The attack exploited a back-end system vulnerability in a third-party tool used by Bitget's wallet operations — not a private-key compromise. Attackers spoofed transaction history and triggered unauthorized withdrawals across multiple chains. Stolen assets — ETH, BNB, AVAX, USDT, and USDC — were rapidly converted into 67,982 ETH, a non-freezable asset, within hours. Preliminary forensic evidence points to infrastructure patterns associated with North Korea's Lazarus Group, though Bitget has declined to formally attribute the attack pending its investigation.
Bitget's User Protection Fund, holding $464 million at the time of the breach, covers the full loss. The exchange has pledged a public incident report within 24 hours and full reimbursement. However, the breach raises structural questions about centralized exchange security architecture and the systemic risk posed by hot wallet exposure — questions the industry has failed to resolve despite $3.4 billion in cumulative 2026 theft losses.
At 18:31 UTC on September 24, 2026, Bitget's internal security monitoring flagged unauthorized transfers originating from a subset of its hot wallets. The exchange activated emergency response protocols within minutes, according to CEO Gracy Chen's public statement on X.
The attacker did not obtain private keys. Instead, the compromise targeted a back-end system vulnerability — specifically, a third-party tool integrated into Bitget's wallet service operations. According to reporting from TechFlow, the attack resembled a supply-chain compromise in which a trusted external dependency was manipulated to spoof transaction history and generate unauthorized withdrawal instructions.
Three hot wallets and one warm wallet were affected across multiple blockchains. Bitget operates a three-tier wallet architecture: hot wallets for immediate liquidity (typically 5-10% of assets), warm wallets as an intermediate buffer (10-20%), and cold wallets holding the majority offline. The cold wallet layer was not breached.
The exchange suspended withdrawals immediately. Deposits and trading remained operational. Affected wallet addresses were flagged across chain-monitoring platforms, and law enforcement agencies were contacted alongside blockchain security firms.
On-chain analytics firm Arkham Intelligence first surfaced the suspicious activity, detecting large-scale outflows of AVAX, BNB, ETH, and stablecoins from known Bitget addresses.
The attacker's conversion strategy was methodical. Stablecoins — USDT and USDC — were immediately swapped for ETH, which cannot be frozen by any centralized issuer. One freshly created wallet spent $19.67 million in USDT0 to purchase 7,111 ETH in six minutes on Arbitrum, paying up to 5% above market price through decentralized exchanges UniswapX and 1inch Fusion, according to CoinDesk reporting.
In total, stolen assets were consolidated into approximately 67,982 ETH. The premium paid on DEX swaps — up to 5% above spot — reflects the attacker's priority: speed over cost efficiency. Freezable stablecoins were the first assets converted. Non-custodial, non-freezable ETH was the destination.
This pattern is consistent with North Korean Lazarus Group operational tradecraft, which prioritizes rapid conversion to non-freezable assets before chain-monitoring tools can flag addresses and before stablecoin issuers (Tether, Circle) can blacklist receiving wallets. The FBI confirmed Lazarus Group responsibility in the February 2025 Bybit hack, which followed an identical conversion pattern.
The Bitget breach bears structural similarity to the Bybit hack of February 2025, in which Lazarus Group operatives stole $1.5 billion by compromising Safe{Wallet}, a multisig platform used in Bybit's signing workflow. In that incident, a Safe developer machine was compromised, malicious JavaScript was injected into the signing interface, and Bybit signers approved a transaction that appeared legitimate but had been altered at the UI level.
The Bitget attack follows an analogous logic: a trusted third-party dependency was exploited to generate fraudulent withdrawal instructions without requiring direct access to exchange private keys. This class of attack — supply-chain compromise — has emerged as the dominant vector in exchange-level breaches since 2025.
According to a Medium analysis by security researcher Arche, supply chain attacks in crypto exploit trust in tools, npm packages, wallet SDKs, and multisig providers. Attackers inject malicious code that steals private keys or manipulates transaction logic from major exchanges downstream. AI-generated malicious commits surged with a 1,000% year-over-year increase through 2026, with changes described as "nearly impossible to distinguish from legitimate developer work."
The pattern is clear. Direct private-key theft has become more difficult as exchanges adopt hardware security modules and multi-party computation. But the software stack surrounding key management — the signing interfaces, the backend tools, the third-party dependencies — remains vulnerable.
Bitget's User Protection Fund held $464 million at the time of the breach, exceeding the $351.6 million loss by $112.4 million. The fund was established as a self-insurance mechanism specifically for security incidents.
The exchange has published 46 consecutive monthly Proof-of-Reserves attestations since December 2022. The most recent report, for August 2026, showed a 122% reserve ratio across 19 tracked assets. The September 2026 update expanded coverage to 19 assets with a 135% reserve ratio, though it is unclear whether this attestation was published before or after the breach.
Chen stated: "Bitget has navigated multiple market cycles. We will not run from this. Every dollar and every decision will be accounted for, transparently and in full."
In context, Bitget is the world's sixth-largest centralized exchange by spot volume and held approximately 11.45% of global derivatives market share as of Q2 2025. The exchange maintained average daily trading volume above $10 billion through April 2026 and recorded $359.37 million in monthly net inflows, ranking second globally among tracked centralized exchanges per DefiLlama data during that period.
Whether a $351.6 million loss — even if covered by the protection fund — erodes user confidence remains to be seen. Bybit recovered operationally from its $1.5 billion loss in February 2025 but experienced sustained net outflows for months afterward.
The Bitget breach pushes September 2026 past April as the costliest month for crypto theft this year. The cumulative toll is severe.
Major 2026 crypto security incidents (exchanges and infrastructure):
| Date | Target | Amount | Vector | |------|--------|--------|--------| | Sep 24 | Bitget | $351.6M | Supply-chain / backend exploit | | Sep 6 | Liquid Network | $320M | Validator software bug | | Aug 4 | Coldcard (hardware wallet) | $116M | Firmware exploit | | Apr | KelpDAO / LayerZero bridge | ~$290M | Bridge exploit | | Various | DeFi protocols (cumulative H1) | $1.3B | Multiple vectors |
CertiK reported $1,315,676,432 stolen across 344 on-chain incidents in the first six months of 2026. Stingrai's aggregate tracker places the 2026 year-to-date total at approximately $3.4 billion across all categories.
The Liquid Network incident offers a partial counterpoint: the attackers, claiming white-hat status, returned approximately 85% ($272 million) of the $320 million they extracted. No such overture has been made in the Bitget case.
The underlying pattern is consistent. According to a webthreepedia comparative analysis published September 23, 2026, stolen private keys — not code bugs — drove the majority of DeFi losses in 2026. The Bitget breach extends this finding to centralized exchange infrastructure: the vulnerability was not in cryptographic key management itself but in the surrounding software supply chain.
The hot wallet model exists because of a fundamental trade-off: exchanges need instant liquidity to process user withdrawals, but any asset connected to the internet is inherently more vulnerable than cold storage.
Industry best practice, according to Safeheron's 2026 architecture guide, recommends holding 80-90% of exchange assets in cold storage, with hot wallets limited to 5-10% of total holdings — enough for operational liquidity. Warm wallets, holding 10-20% with multi-signature schemes, serve as a buffer.
Bitget's three-tier architecture appears to have followed this framework. The breach was contained to hot and warm layers. Cold wallets held. But $351.6 million still drained.
The economic calculus is stark. Exchanges earn revenue from trading fees, typically 0.1-0.2% per trade. At $10 billion daily volume, Bitget generates roughly $10-20 million per day in fees. The $351.6 million loss represents approximately 18-35 days of gross trading revenue — before operating costs.
The User Protection Fund provides a buffer, but it represents capital that could otherwise be deployed productively. Insurance costs in crypto remain prohibitive. According to a webthreepedia deep dive from September 23, the DeFi sector carries a $93 billion insurance gap, with the vast majority of on-chain assets uninsured. Centralized exchanges face a parallel problem: self-insurance through protection funds is the de facto standard because third-party coverage is either unavailable or priced beyond viability.
The Bitget breach is not an outlier. It is the latest data point in a pattern that has defined crypto exchange security since the Bybit hack of February 2025: sophisticated state-level actors targeting the software supply chain rather than cryptographic infrastructure directly.
Bitget's financial position — a $464 million protection fund, 46 consecutive proof-of-reserves attestations, and a 135% reserve ratio — places it in a stronger position to absorb the loss than most exchanges would be. The immediate financial risk to users appears contained, contingent on the protection fund disbursement proceeding as pledged.
The systemic risk is harder to contain. The crypto industry processed $3.4 billion in cumulative theft losses through 2026, per Stingrai data. Exchanges continue to hold billions of dollars in hot wallets because the business model demands instant liquidity. The supply chain that connects hot wallets to the internet — the backend tools, the signing interfaces, the third-party dependencies — remains the attack surface. Until the industry develops architectural alternatives that decouple liquidity from exposure, the next breach is a question of when, not whether.