Inside the $351.6M Bitget Hack: How It Happened and What Comes Next

On September 24, 2026, at exactly 18:31 UTC, Bitget's internal monitoring systems flagged something wrong. Within the next two hours and fifty-two minutes, hundreds of millions of dollars in crypto quietly left wallets tagged with the exchange's name, routed through Arbitrum, converted into ether at prices no rational buyer would pay, and scattered across new, unlabeled addresses.

By the time the dust settled, Bitget had confirmed a loss of $351.6 million, according to Bloomberg — making it, at least for now, the single largest crypto exchange hack of 2026. This isn't a rumor pieced together from screenshots. It's a story that can be verified block by block, transaction by transaction, on public blockchains that anyone can check for themselves. This article walks through exactly what happened, what's confirmed versus still unclear, and why the way this attacker moved money tells us almost as much as the amount they took.

How the Breach Was Discovered

Bitget says its own security systems caught the intrusion in real time. In an official notice on X, CEO Gracy Chen stated that unauthorized transfers from company hot wallets were detected at 18:31 UTC on September 24, triggering emergency response protocols immediately, a detail also reported by BleepingComputer.

What's notable is that on-chain researchers spotted the anomaly at almost the same moment the exchange did, without any inside information. Pseudonymous analyst DCF GOD, described by Forbes as a researcher with roughly 105,000 followers, flagged unusual activity on Arbitrum before Bitget had said a word publicly. Within minutes, independent blockchain sleuths and Bitget's internal team were effectively watching the same crime unfold from two different directions — one from inside the company, one from the outside looking at nothing but public ledger data.

The On-Chain Timeline, Minute by Minute

Blockchains are permanent public records, which means this attack can be reconstructed with unusual precision. Newsletter Wu Blockchain logged the visible outflow window as running from 18:31 to roughly 20:55 UTC on September 24.

The Opening Move

The attack didn't start with a massive transfer. It started small — a modest amount of ETH sent to a brand-new wallet created that same day. In hindsight, this reads as a test transaction: a way to confirm an address works and a route is clear before committing to the real theft. This is a pattern security researchers have seen before in large-scale exchange breaches, including the Bybit hack a year earlier, where on-chain investigator ZachXBT's proof of Lazarus Group involvement specifically cited "a detailed analysis of test transactions and connected wallets," according to reporting from Forklog.

The Real Money Moves — And the Race Against Freezes

The most revealing moment of the entire breach happened on Arbitrum. According to Decrypt, a freshly created wallet took roughly 19.67 million USDT0 from a Bitget-labeled hot wallet and converted it into 7,111 ETH in about six minutes, routing the trade through UniswapX and 1inch Fusion.

That conversion wasn't cheap. DCF GOD calculated the attacker paid up to 5% above the going market rate, an overpay so aggressive it briefly pushed one WETH/USDC pool to around $2,870 while the real spot price sat closer to $2,688, a gap confirmed independently by CoinDesk and Forbes. As DCF GOD put it in the post that first surfaced the anomaly, overpaying that dramatically "makes no sense if someone was just trying to buy eth."

It makes complete sense, though, if the goal isn't a good price — it's speed. Stablecoins like USDT and USDC are centrally issued, which means the companies behind them can freeze suspicious addresses at the smart-contract level. Ether has no such kill switch. Every dollar of stablecoin this attacker touched got raced into ETH within minutes of arriving, price be damned, because a slightly worse exchange rate is a far smaller loss than having millions of dollars frozen mid-heist.

From there, more Bitget-labeled wallets sent additional ETH, USDT, USDC, AVAX, BNB, and even XAUT — a gold-backed token — into the same growing pile of stolen assets, a flow of funds independently tracked by both Decrypt and ChainCatcher. Etherscan later tagged the primary receiving address as "Bitget Exploiter 1."

Two Numbers, One Gap: How Much Was Actually Stolen?

Here's where the story gets a little more nuanced than a single headline figure suggests. Independent on-chain analysts, working only from public wallet labels, initially estimated the damage at somewhere between $174 million and $190 million, a range reported consistently across BigGo Finance, CoinDesk, and Wu Blockchain.

Bitget's own internal figure, announced hours later, came in significantly higher: $351.6 million. The company's explanation, according to Bloomberg, is that the affected wallets spanned multiple chains and asset types beyond what was immediately visible through public wallet tags — meaning outside researchers were seeing roughly half the true picture in real time. Both numbers are worth knowing: $180 million is what could be independently verified block-by-block as the story broke, while $351.6 million is the exchange's own internal accounting once it completed a full sweep of every affected wallet.

What Bitget Says Happened — And What It's Promising Customers

CEO Gracy Chen has been the primary public voice throughout the incident. In her statement, carried by Bloomberg, she was direct about the scope of protection for ordinary users: "User funds are safe... The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million."

That fund, according to BleepingComputer, is backed by roughly 5,500 BTC. Bitget has framed this loss as a corporate balance-sheet hit rather than something that will touch customer balances — a distinction that matters enormously to anyone with funds sitting on the platform. Bitcoin.com News reported that customer account balances continued to accurately reflect users' holdings throughout the incident, and that the exchange is treating the stolen funds as its own loss to absorb, not one to pass on to depositors.

Bitget also confirmed it's working with outside help rather than handling this alone. BleepingComputer reported the exchange brought in law enforcement, on-chain security firms, and cybersecurity specialists at Mandiant and SlowMist to assist with the investigation. Separately, Bitget said its self-custodial Bitget Wallet product — which runs on completely different infrastructure from the exchange — was not affected at all.

What Wasn't Touched: Why This Could Have Been Much Worse

A detail that's easy to miss in the headline number: this breach was not a total wipeout. According to on-chain observations reported by BigGo Finance, the affected wallets still held approximately $530 million in additional assets even after the attacker finished moving funds — meaning the intrusion was either contained before it could go further, or the attacker chose to stop. Bitget has stated that its cold wallet reserves, which hold the bulk of exchange assets offline and away from internet-connected systems, remained completely secure throughout.

That distinction between hot, warm, and cold wallets is at the center of how this attack was structured. Hot wallets stay connected to the internet so an exchange can process withdrawals quickly, which makes them useful but also exposed. Cold wallets stay offline and are far harder to compromise remotely — which is exactly why they came through this incident untouched.

The Root Cause: Not Stolen Keys, But Spoofed Transactions

For the first day of coverage, the biggest open question was simple: how did the attacker actually get in? Bitget has since given a partial answer. According to CoinDesk, Chen said the attacker did not steal Bitget's private keys. Instead, she described a more surgical intrusion: "The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered..." the exchange's own internal authorization process, effectively tricking Bitget's systems into approving transfers that looked legitimate from the inside.

That's a meaningfully different kind of failure than a stolen seed phrase or a leaked private key. It suggests the weak point was in the software layer that verifies and signs off on transactions — the "gatekeeper" logic — rather than the cryptographic keys themselves. Bitget has said a fuller technical report detailing the exact root cause is still forthcoming.

Who's Behind It? The North Korea Question

Chen has publicly pointed toward North Korea's Lazarus Group as the likely culprit. CNBC reported she called the pattern of the breach highly consistent with known tactics used by North Korean state-linked hacking collectives, and TechCrunch noted she has personal history with the group, having previously lost funds from one of her own wallets to a similar operation.

This isn't a wild guess. According to blockchain intelligence firm TRM Labs, cited by TechCrunch, North Korea is estimated to be behind roughly three-quarters of all crypto theft recorded so far in 2026. These operations aren't opportunistic — investigators and multiple governments have linked this pattern of theft to funding for North Korea's weapons programs.

How This Compares to the Bybit Hack

If the stablecoin-to-ETH laundering pattern here feels familiar, that's because it closely mirrors the largest crypto hack in history: the February 2025 Bybit breach. In that incident, attackers compromised a multisig wallet interface during a routine transfer and made off with roughly $1.4–1.5 billion in ETH, a scale confirmed by The Block and blockchain analytics firm Arkham Intelligence, which attributed the attack to Lazarus Group. Bybit's response is now something of an industry case study. CEO Ben Zhou secured emergency bridge loans and support from other exchanges — including a reported 40,000 ETH loan from Bitget itself — and according to BitPinas, the exchange processed over 350,000 withdrawal requests within ten hours, completing 99.994% of them. Bybit survived the hack and remained among the largest exchanges by trading volume afterward. Bitget's current loss is roughly a quarter of that scale, and the exchange appears to be following a similar transparency-first playbook: disclose fast, freeze withdrawals, guarantee customer funds, and lean on reserves rather than deny or downplay the incident.

What This Means for the Wider Crypto Industry

This hack didn't happen in isolation. It's part of what's shaping up to be an unusually costly year for centralized exchange security. TechCrunch's reporting places this as the largest theft of 2026 so far, and combined tallies from multiple outlets show September's crypto hack losses have now pushed past $684 million — surpassing April 2026's previous monthly high of roughly $647 million.

Bitget's own token, BGB, fell around 5% in the hours following the disclosure, based on Bloomberg's market data, though the broader crypto market reportedly held up, up roughly 10% over the preceding week — a sign that traders are, for now, treating this as a Bitget-specific event rather than a systemic risk to the sector. That could change quickly if withdrawals remain frozen for an extended period, since prolonged freezes tend to erode user confidence even at exchanges that ultimately make customers whole.

Lessons for Everyday Crypto Users

You don't need to be a blockchain analyst to take something useful away from this. A few practical points worth remembering:

• Hot wallets are a trade-off, not a guarantee. Convenience for fast withdrawals comes with more exposure. Exchanges that separate hot, warm, and cold storage — and keep the bulk of assets offline — limit the blast radius when something goes wrong.
• A transparent, well-funded reserve matters. Bitget's ability to say losses fall entirely within an existing $464 million protection fund is the difference between a contained incident and a customer-funds crisis.
• Speed and transparency shape outcomes. Both Bybit and Bitget disclosed quickly, froze withdrawals, and gave regular public updates. That approach, while not able to undo a hack, appears to meaningfully preserve user trust compared to silence or denial.
• On-chain transparency is a real form of accountability. Independent researchers like DCF GOD and ZachXBT spotted these breaches using nothing but public blockchain data, often before the exchanges themselves said anything. That's one advantage crypto has over traditional finance: anyone can watch the money move.

Timeline Recap

• 18:31 UTC, Sept 24: Bitget's systems detect unauthorized transfers from hot wallets; emergency protocols triggered.
• Shortly after: A small test transaction moves funds to a newly created wallet.
• ~18:59–19:01 UTC: Large transfers begin across Ethereum and Arbitrum, including tens of millions in USDT, USDT0, USDC, and ETH.
• Within 6 minutes on Arbitrum: 19.67 million USDT0 converted into 7,111 ETH via UniswapX and 1inch Fusion, at up to 5% above market price.
• Through ~20:55 UTC: Additional Bitget-labeled wallets send ETH, AVAX, BNB, USDC, USDT, and XAUT to the same address.
• Early hours, Sept 25: Bitget publicly confirms the breach, halts withdrawals, and commits to covering losses via its User Protection Fund.
• Following hours: CEO Gracy Chen attributes the breach to a compromised backend system and points to North Korea's Lazarus Group as the likely actor.

Frequently Asked Questions

Is my money safe if I have funds on Bitget?

Bitget has stated customer balances were not altered and that the full loss is covered by its User Protection Fund, which holds over $464 million. Cold wallet reserves, where most customer assets are typically stored, were reported as unaffected.

Why did the attacker convert stablecoins into ETH so quickly, even at a bad price?

Stablecoins like USDT and USDC can be frozen by their issuing companies if flagged as stolen. Ether has no such freeze mechanism, so converting stolen stablecoins into ETH quickly — even at an inflated price — makes the funds much harder for investigators or issuers to recover.

Were Bitget's private keys stolen?

According to CEO Gracy Chen, no. She described the intrusion as a compromise of a backend system that allowed the attacker to spoof transaction data and trick the exchange's own authorization process, rather than a theft of private keys directly.

How does this compare to other major crypto hacks?

At $351.6 million, this is smaller than the February 2025 Bybit hack, which remains the largest crypto exchange breach in history at roughly $1.4–1.5 billion. Both incidents have been linked to North Korea's Lazarus Group and both exchanges kept operating by using reserve funds and, in Bybit's case, emergency bridge loans.

When will Bitget's withdrawals reopen?

As of the latest updates, Bitget has not given a firm timeline, saying withdrawals will remain paused until its security review is complete. Deposits and trading have continued to operate normally throughout.

Final Thoughts

What makes this incident worth understanding isn't just the dollar figure — it's how visible the entire attack was in real time, to anyone willing to watch a block explorer. A test transaction. A race against stablecoin freeze functions. A six-minute scramble to lock in ether before anything could be blocked. None of this required insider access to piece together; it was sitting in public view the entire time.

For an industry still working out how to balance speed, convenience, and security, the Bitget hack is another data point in a pattern that's becoming familiar: sophisticated state-linked actors, fast-moving laundering techniques, and exchanges that increasingly respond with transparency and reserve funds rather than silence. Whether that response is enough to maintain long-term trust will depend on what Bitget's promised technical report reveals — and how quickly withdrawals return to normal.