Bitget reported a security breach involving unauthorized transfers from its hot wallets. Hackers compromised the backend wallet system by forging transaction approvals, though the company confirmed that cold wallets and private keys remained secure. The total value of stolen assets, including Ether, XRP, USDT, USDC, Avalanche, and BNB, reached $387.5 million.
To prevent asset freezing, the attackers converted stablecoins into ETH on decentralized exchanges within minutes. Other native assets were fragmented across multiple new wallets. Bitget responded by temporarily freezing user withdrawals and announced that its User Protection Fund, valued at over $464 million, will cover all losses. The platform has since patched the backend vulnerability.
The exchange is implementing a staggered withdrawal schedule starting Monday, September 28, to manage infrastructure traffic. Additionally, Bitget has launched a recovery-bounty program, offering rewards of up to 5% for the successful recovery or freezing of stolen funds. Investigators have linked the incident to North Korean hacker groups based on IP addresses associated with known VPN infrastructure.
This incident follows a series of large-scale crypto thefts, including the loss of $320 million from the Liquid Network and $270 million from Drift earlier this year. Authorities have previously attributed major cyberattacks, such as the $1.5 billion theft from Bybit in February 2025, to state-sponsored actors from North Korea.
