A globally top-ranked exchange was hit after midnight on the 24th, with $387.5 million taken from its wallets. This is the largest exchange theft so far in 2026.

📌 The method is more worth looking at than the amount. It wasn’t that private keys were stolen. Bitget’s CEO said the attackers compromised a backend component of the wallet system, then forged transaction data, bypassed the exchange’s own signing process, and transferred the funds out. Cold wallets are fine; self-custody wallets are fine.

⚠️ A simple analogy: the thief didn’t get your home keys. Instead, they slipped into the key-cutting shop, and had the shop owner make them a key themselves.

The aftermath is equally crucial. Bitget said users’ balances would not be affected; the loss would be covered by the users’ protection fund ($464 million, about 5,500 BTC). Withdrawals will resume in batches starting today. But on the on-chain tracking side, Circle and Tether only froze about $318,000—meaning the money was largely already swapped and gone. North Korea is suspected to be behind it; the official statement says it is “very likely,” but no technical evidence has been made public.

$BTC users most easily overlook this point: the “balance” shown on an exchange is, in essence, an IOU from the exchange—not your coins. Whether that IOU can be cashed out depends on whether the exchange was safe that day.

What percentage of your holdings would you leave on an exchange right now? #Bitcoin #Crypto