On September 24, 2026, Bitget suffered a major security breach resulting in the loss of approximately $387.5 million from its hot and warm wallets. The attack originated from a zero-day vulnerability in third-party security software, which allowed unauthorized access to high-level credentials.
The exchange confirmed that its cold wallets and private keys remained secure. Following the incident, Bitget suspended withdrawals and began a gradual restoration process on September 28. The company stated that user losses will be fully covered by its User Protection Fund, which held over $464 million prior to the breach.
Bitget criticized several DeFi protocols for refusing to assist in tracking stolen assets. In contrast, the cross-chain protocol NEAR Intents used its SHIELD system to identify and block over $50 million in laundering attempts. Specifically, SHIELD froze $503,000, while $166,000 was moved before detection.
Stablecoin issuers Tether and Circle also participated in recovery efforts, freezing between $320,000 and $340,000 in stolen funds. Despite these actions, only about 0.2% of the total stolen assets have been recovered. Investigations into the perpetrators remain ongoing, with no confirmed affiliation to any specific group.
