Bitget Hack: What We Actually Know Hours After the Hack
🔹 ≈$351.6M left Bitget's hot wallets after its security system flagged the first unauthorized transfer at 18:31 UTC on September 24. Cold wallets were not affected.
🔹 Surprising method: no private keys were stolen. According to CEO Gracy Chen, the attacker breached a backend system and falsified transaction data, so Bitget's own infrastructure approved the withdrawals.
🔹 Main losses:
· XRP: 102.9M XRP (≈$157.5M)** — largest single loss
· ETH: **31,890 ETH (≈$85.8M)
· Stablecoins: ≈$75.5M**
· Most EVM funds have already been swapped into **67,982 ETH (≈$183M)
🔹 Attribution: Chen points to IP addresses linked to VPNs used by a DPRK group. On-chain investigators connect the XRP trail to the July AFX hack, attributed to TraderTraitor (linked to Lazarus). No technical proof has been published yet.
🔹 Coverage: the 5,500 BTC (≈$464M) User Protection Fund absorbs the loss and is expected to be replenished later. Deposits and trading remain open, balances are intact, and Mandiant and SlowMist are investigating.
🔹 Withdrawals frozen with no reopening date. When Bybit lost $1.5B in February 2025, it never suspended withdrawals, partly because Bitget had lent it 40,000 ETH. This time, the roles are reversed.
🔹 Context: September is already 2026's worst month for hacks, with over $700M** lost, including Liquid's **$320M on September 7.
Key Takeaway
This doesn't mean cold storage failed. It means the weak point has shifted to the centralized system that decides what a hot wallet is allowed to send.
What to Watch
To assess the real scope of the impact:
· ⏳ How quickly withdrawals reopen
· 📄 Whether the incident report actually explains the backend breach
🔹 ≈$351.6M left Bitget's hot wallets after its security system flagged the first unauthorized transfer at 18:31 UTC on September 24. Cold wallets were not affected.
🔹 Surprising method: no private keys were stolen. According to CEO Gracy Chen, the attacker breached a backend system and falsified transaction data, so Bitget's own infrastructure approved the withdrawals.
🔹 Main losses:
· XRP: 102.9M XRP (≈$157.5M)** — largest single loss
· ETH: **31,890 ETH (≈$85.8M)
· Stablecoins: ≈$75.5M**
· Most EVM funds have already been swapped into **67,982 ETH (≈$183M)
🔹 Attribution: Chen points to IP addresses linked to VPNs used by a DPRK group. On-chain investigators connect the XRP trail to the July AFX hack, attributed to TraderTraitor (linked to Lazarus). No technical proof has been published yet.
🔹 Coverage: the 5,500 BTC (≈$464M) User Protection Fund absorbs the loss and is expected to be replenished later. Deposits and trading remain open, balances are intact, and Mandiant and SlowMist are investigating.
🔹 Withdrawals frozen with no reopening date. When Bybit lost $1.5B in February 2025, it never suspended withdrawals, partly because Bitget had lent it 40,000 ETH. This time, the roles are reversed.
🔹 Context: September is already 2026's worst month for hacks, with over $700M** lost, including Liquid's **$320M on September 7.
Key Takeaway
This doesn't mean cold storage failed. It means the weak point has shifted to the centralized system that decides what a hot wallet is allowed to send.
What to Watch
To assess the real scope of the impact:
· ⏳ How quickly withdrawals reopen
· 📄 Whether the incident report actually explains the backend breach
