Top exchange Bitget was hacked at 2:31 a.m. on September 25, Taipei time. As of the time of writing on September 27, Bitget’s official funds-tracking page shows the actual amount stolen as $391.22 million, which converts to approximately NT$12.4 billion.
This number is slightly higher than the $387.5 million announced by the official on September 25. The difference is that the tracking page additionally includes stolen assets on three chains: ALGO, TIA, and ATOM. And as the official published on the 26th a timetable for the resumption of withdrawals, this incident has finally come to a preliminary close.
The official processing timeline is as follows (Taipei time):
9/25 05:39: The website published its first announcement, initially estimating losses of $351.6 million, pausing withdrawals, while deposits and trading continued as normal
9/25 06:26: CEO Gracy Chen went straight into the spotlight, explaining on X Live for more than three hours, stating that the protection fund was sufficient to fully compensate users
9/25 11:11: The official Traditional Chinese Threads account said the protection fund was 5,500 bitcoins; losses would be covered by the fund, and more details would be provided later
9/25 22:05: The website upgraded the loss estimate to $387.5 million, 공개ly shared the hacker’s address and tracking page, and launched a 5% recovery bounty
9/26 11:55: The website announced withdrawal restoration in four batches, finishing 5 minutes before the noon deadline it had promised
9/28 16:00: They began to sequentially open withdrawals for Bitcoin, Ethereum, and USDT; other coin types had to wait until 10/2
Actually, this hack didn’t steal the password that controls the wallet—meaning the “private key.” Gracy said the hacker compromised the wallet system’s backend, forged transfer instructions that were formatted completely normally, and then sent them through the approval process the exchange uses every day.
In short, the vault keys are still there, but someone forged withdrawal slips that look “official.” The assets that were moved away mainly came from connected hot/warm wallets; offline wallets holding large amounts of assets were not affected.
As for who did it, Gracy said the hacker’s IP characteristics highly match the records of a North Korea–linked hacking organization in the past, but until the investigation results come out, they won’t make a definitive conclusion.
－－－
According to the official tracking page, calculated using the price at the time of the hack, the largest loss amounts are the following four items:
XRP: about 103 million units, worth approximately $158 million
Ethereum: about 319,000 units, worth approximately $85.78 million
Stablecoins: USDT, USDC, and USDT0 total approximately $75.48 million
ZEC: about 18,900 units, worth approximately $29.36 million
But the XRP with the most stolen amount isn’t included in the list of the first three batches of withdrawals. It has to wait until 10/2 together with other tokens. The reason can be found in clues from the proof of reserves Bitget published on September 16.
At that time, the total amount of XRP on the platform was only about 104 million units, of which 66.81 million belonged to users. So, based on this snapshot, it’s as if the platform’s XRP was almost completely drained—XRP needed to be replenished first before users could withdraw.
However, most of the money stolen is still, for the most part, in the hands of the hacker. The tracking page shows the hacker still holds about 96%, and only about $339,000 has been frozen by Tether and Circle.
Fortunately, the loss amount from this hacking incident is still within the range that Bitget’s protection fund can cover, so for users, the impact will be limited for now.
－－－
Finally, I’d like to share my own view. I currently still have money in there, but I’m not extremely panicked. I think Bitget’s crisis handling this time was at least acceptable: it published the hacker’s address and the tracking page, and it also submitted a withdrawal schedule on time. Based on what we can see now, there’s a chance it could end safely like Bybit.
From 9/25 early morning to 10/2— even if users’ assets weren’t affected, they still had to wait 7 and a half days to withdraw all their coins. So whether the exchange can “afford to pay” and when you can “actually withdraw,” are ultimately two different things.
As for offshore exchanges like Bitget, they are not on the list of 10 money-laundering prevention registered entities completed with the Financial Supervisory Commission. If something really does happen, under Taiwan’s current regulations, no agency can help you get your money back.
After this incident, I still want to urge people in the crypto market to try being a fickle “player”/“player queen”—don’t put all your assets on a single platform/exchange.
How are your crypto assets currently distributed across several platforms? If one of them had an issue, could you hold up?
Feel free to share with me~
⚠️ The content above is for reference only and does not constitute any investment advice.