Bitget detected unauthorized transfers from its hot and warm wallets on September 24, 2026, at 18:31 UTC. The exchange immediately suspended all withdrawals following the incident. Initial damage estimates of $351.6 million were later revised to $387.5 million after investigators identified stolen assets on the Zcash and Tron networks.
CEO Gracy Chen stated that the breach did not involve the theft of private keys. Instead, attackers exploited a vulnerability in the backend wallet infrastructure to spoof transaction authorization data. Cold wallets remained secure throughout the attack. The exchange attributes the incident to North Korean hacking groups based on IP patterns and on-chain analysis.
The company is currently working with law enforcement, cybersecurity firm Mandiant, and blockchain analytics firm SlowMist. While trading and deposits remained active, the native BGB token price fell by approximately 3.3% following the news. This event marks the largest single exchange hack recorded in 2026.
To address the financial impact, Bitget plans to utilize its User Protection Fund, which holds over $464 million. The exchange confirmed that user balances were not affected by the unauthorized outflows and has committed to publishing a full incident report.
