Bitget experienced a major security breach on September 24, 2026, at 18:31 UTC, resulting in the loss of $387,5 million in unauthorized withdrawals. The attackers targeted hot and warm wallets using spoofed transaction data, stealing assets including approximately 103 million XRP valued at roughly $157 million, as well as ETH and USDT.
The company initially estimated losses at $351,6 million, but later revised the figure to $387,5 million. CEO Gracy Chen stated that the attack patterns and IP analysis suggest involvement by North Korean hacking groups. Bitget has engaged Mandiant and SlowMist to conduct an investigation and address security vulnerabilities.
To compensate affected users, Bitget plans to utilize its User Protection Fund, which holds over $464 million. This amount is sufficient to cover the total losses, leaving a surplus of approximately $76 million. Currently, the platform has suspended withdrawals while it implements security upgrades.
Despite the incident, CEO Gracy Chen confirmed that Bitget intends to proceed with an IPO within the next three years. Chen noted that 2026 remains a difficult year for crypto firms seeking public listings due to intense competition for capital from the AI and space technology sectors.
