The breach occurred on September 24, 2026, resulting in the theft of approximately $387.5 million from Bitget's hot and warm wallets. This incident is currently recognized as the largest digital asset theft of 2026. Investigators report that the stolen funds are being laundered via public Discord and Telegram channels, utilizing services such as Wasabi to obscure transaction trails.
Blockchain investigator ZachXBT identified specific actors, including those using the handles cc02006 and jack_34808, who are linked to North Korea-affiliated groups like Lazarus and TraderTraitor. Evidence suggests a connection to the earlier $292 million Kelp DAO exploit, indicating a systematic laundering network responsible for nearly $680 million in losses this year.
The attackers gained access by compromising a third-party backend system, which allowed them to spoof transaction data and bypass authorization protocols. Bitget confirmed that private keys remained secure and cold wallets were not affected. Following the incident, the exchange suspended withdrawals, with a phased restoration process beginning on September 28.
To address the losses, Bitget is utilizing its User Protection Fund, which holds over $464 million. The exchange has also announced a 5% bounty for the recovery of the stolen assets, valued at approximately $19.4 million. Cybersecurity firms Mandiant and SlowMist have been engaged to conduct a formal investigation alongside law enforcement agencies.
