Bitget: Hackers Took $387.5 Million by Faking the Exchange's Own Paperwork

At 18:31 UTC on 24 September 2026, half past seven in the evening in London, Bitget's security systems flagged money leaving the company that nobody at the company had asked to send. Bitget is a crypto exchange, a business that works like an online stockbroker: it holds its customers' digital money and lets them buy and sell. Over the next three hours its own systems paid out hundreds of millions of dollars to strangers, and approved every payment as it went.

The final count was $387.5 million. Bitget first put the figure at $351.6 million, then raised it the next day after finding missed transfers on two more networks, Zcash and TRON. That makes it the largest crypto theft of 2026 so far, ahead of the $319 million taken from Liquid Network earlier in September and the April attacks on Kelp DAO ($292 million) and Drift Protocol ($285 million).

Bitget was founded in Singapore in 2018, is registered in the Seychelles and says it serves more than 120 million users. Its chief executive, Gracy Chen, confirmed the breach on X at about 21:30 UTC, three hours after it began. Outsiders had already noticed. Emmett Gallic, an analyst at the blockchain tracking firm Arkham Intelligence, posted at 20:24 UTC that Bitget appeared to have been hacked for about $178 million.

©CMZ chart. Data: Bitget, TRM Labs

How it worked

Exchanges keep customer money in layers. Most of it sits in "cold" storage, held offline like gold in a vault. A smaller amount sits in "hot" wallets connected to the internet, the equivalent of the cash drawer at a bank counter, so customers can withdraw quickly. Bitget also runs a middle "warm" layer that refills the drawer. Money leaves any of them only when the exchange's authorisation system approves a transfer and signs it with a private key, the digital version of a bank manager countersigning a cheque.

Nobody stole a password, and the attackers never touched the keys. According to Chen, they compromised "a critical backend system within our wallet infrastructure", used it to spoof transaction data, and let Bitget's own authorisation process do the rest. In banking terms, a thief inside the accounts department slipped forged payment instructions into the day's batch. The manager's countersignature on each one was genuine. The instructions were not. "Private key compromise has been ruled out," Chen said. The cold vault was untouched. Bitget has not said publicly how the attackers got into that back-office system in the first place.

The payouts came in bursts. Bitquery, a blockchain data company that rebuilt the sequence, counted 21 transfers across eight blockchains, which are separate payment networks with their own coins, much as different stock exchanges settle their own trades. Two bursts, at 19:01 and 19:16 UTC, each took no more than 15 seconds. The last transfer went at 21:23 UTC. The haul included about 103 million XRP worth roughly $157 million, the largest single piece, plus ether, BNB, AVAX, TRX and Zcash, the stablecoins USDT and USDC (digital dollars issued by Tether and Circle), and even XAUt, a Tether token backed by gold.

©CMZ chart. Data: Bitquery

The trick was not new. In February 2025 the exchange Bybit lost about $1.5 billion when the staff approving a routine transfer saw one thing on their screens while the blockchain received another. The software showing them the details, supplied by an outside firm called Safe{Wallet}, had been tampered with, and the FBI blamed North Korea. Both times the signatures were real and the paperwork was fake.

Who did it

Chen said North Korean involvement was "very likely". Investigators, she said, had found internet addresses matching the VPN services, tools that disguise where a computer really is, previously favoured by a North Korean hacking group. Bitget has brought in Mandiant, the incident-response arm of Google, and the security firm SlowMist, and has informed law enforcement.

The blockchain analysts went further. TRM Labs found that the wallets laundering the money overlapped with those used after the Bybit theft and after the July 2026 raid on AFX Trade's bridge, and said it had never linked that laundering network to anyone else. Its conclusion was that the overlaps point to TraderTraitor, the name the FBI gave the North Korean operation behind Bybit, part of the wider Lazarus Group. Elliptic counts Bitget as the largest theft attributed to North Korea this year and says it pushes the country's suspected crypto haul for 2026 past $1 billion. No government has formally attributed the attack, and nobody has been charged.

Chen says she has met these people before. About eighteen months earlier she lost roughly $80,000 from a personal wallet after attackers posing as journalists from a crypto news outlet approached her for an interview, and she has linked that incident to the same North Korean group. There is a further irony. When Bybit was robbed in 2025, Bitget lent it 40,000 ether, then worth more than $100 million, with no interest and no collateral, so Bybit could keep paying its customers. Bybit repaid the loan within days.

Where the money went

The attackers moved first on anything that could be frozen. Stablecoins such as USDT and USDC have an off switch: Tether and Circle can blacklist an address, much as a bank can freeze an account. Elliptic found the stolen stablecoins were quickly swapped into each network's own coin. The issuers still froze about $0.3 million, less than a tenth of one per cent of the total. XRP has no such switch, not even for Ripple, the company most closely tied to it, and by 26 September about $83 million of the stolen XRP had been moved on, according to CoinDesk.

Much of the rest sat still. On 26 September, 68,295 ether worth about $184 million rested in eight untouched wallets, according to Bitquery. Smaller sums went through THORChain and Chainflip, services that swap one coin for another across networks without asking who is swapping, and came out as bitcoin: about 127 bitcoin, roughly $10.6 million, by the afternoon of 25 September. On 27 September the tracing firm AMLBot followed about 4 bitcoin into Wasabi Wallet's CoinJoin, a mixer that pools many people's coins so that individual payments can no longer be told apart.

THORChain became the argument. On 26 September Chen publicly asked it to refuse service to the attackers' addresses, arguing that decentralisation should not be a shield for moving known stolen money. THORChain declined, replying on X that it is decentralised and permissionless, like Bitcoin, Ethereum and BNB Chain. Star Xu, founder of the rival exchange OKX, answered that a network able to halt itself when its own funds are at risk, but unwilling to do so for anyone else's, is not like Bitcoin. The row is a rerun. After the Bybit theft, roughly $1.2 billion of the stolen money passed through THORChain.

What happened next

Bitget says no customer will lose money. It is paying for the loss from its User Protection Fund, a reserve set aside for exactly this kind of event, and has promised to refill it. The fund holds 5,500 bitcoin, worth about $464 million when the theft was announced. Because it is held in bitcoin rather than dollars, the cover moves with the market: 5,500 bitcoin pays for $387.5 million only while bitcoin stays above roughly $70,500. On the morning of 28 September bitcoin traded near $83,000, according to CoinGecko.

Customers could trade and deposit throughout, but they could not take anything out, the position of a broker's client who can buy and sell shares but cannot withdraw cash. Bitget's reopening plan starts with bitcoin at 08:00 UTC on 28 September, then ether on 29 September, USDT on 30 September and everything else, including withdrawals in ordinary money, on 2 October. At 06:00 UTC on 28 September, two hours before the start, Bitget's public data still showed withdrawals switched off on every network.

Bitget has also put a price on getting the money back: 5% of any funds frozen and another 5% of any funds recovered, paid to whoever makes it happen, with Bybit's LazarusBounty site as one of the channels. Changpeng Zhao, founder of Binance, offered help without saying what kind. Bitget's own BGB token, whose price tends to track confidence in the exchange, fell a few per cent the next day. Chen, meanwhile, repeated that Bitget still plans to list its shares on a stock market within three years.