Bitget Hack: $387.5 Million Stolen, Withdrawals Reopen Today

Sometime around 6:31 PM UTC on September 24, a wallet that had existed for only a few minutes started buying ether at up to 5% above the market price. It swapped $19.67 million of a dollar-pegged stablecoin for 7,111 ETH in roughly six minutes — the kind of trade no sane treasury desk would ever make. That overpaying wallet was the first public clue that Bitget, one of the world's largest crypto exchanges, was being robbed.

By the time Bitget finished counting, $351.6 million was gone from its online wallets. Two days later, on September 26, the exchange revised the figure to roughly $387.5 million after finding stolen assets on the Zcash and TRON networks as well. Seven networks were hit in total, making this the biggest crypto exchange breach of 2026 — larger than the $320 million Liquid Network exploit from earlier this month.

No Keys Stolen — The System Was Fooled

A quick bit of jargon worth unpacking: exchanges keep most customer crypto in "cold wallets" that stay offline, and a smaller float in "hot" and "warm" wallets that sit connected to the internet so withdrawals can run automatically. Bitget CEO Gracy Chen says the attackers never touched the cold storage and never stole a single private key. Instead, they breached a backend wallet system, fed it fabricated transaction data, and tricked the exchange's own approval process into signing off on the transfers.

That detail matters more than the dollar figure. Stealing keys is a lock-picking problem; fooling the machine that approves withdrawals is a logic problem, and every exchange running similar code has to now ask whether its own checks would catch the same trick. The attackers also knew exactly how the endgame works. Stablecoins like USDT and USDC can be frozen by their issuers once flagged — ether can't. Racing to convert before the freeze is why that first wallet happily overpaid. In the end, issuers managed to freeze only about $318,000.

Withdrawals Reopen Today, in Phases

Bitget froze withdrawals within hours of detecting the breach, while deposits and trading kept running. The freeze lifts in stages, starting today:

• September 28, 08:00 UTC — Bitcoin withdrawals reopen
• September 29 — Ethereum withdrawals reopen
• September 30 — USDT withdrawals reopen
• By October 2 — all remaining tokens, fiat, and peer-to-peer trading

Chen says user balances were never touched and that Bitget's User Protection Fund, holding more than $464 million, will absorb the entire loss. Forensics firms Mandiant and SlowMist are working the case alongside law enforcement, and Bitget is offering a 5% bounty on funds frozen and another 5% on funds recovered. A public Q&A with Chen is scheduled for today.

"We will not run from this. Every dollar and every decision will be accounted for, transparently and in full." — Bitget CEO Gracy Chen

The North Korea Question

Chen says the attackers were "very likely" North Korean, pointing to IP addresses that match VPN services — tools that mask internet traffic — associated with a North Korean hacking group. Treat that as a working theory for now, not proof; VPN-based attribution is thin evidence this early, and no law enforcement agency has backed the claim publicly yet.

But the pattern is familiar. Fast withdrawals spread across many chains, an instant dash from stablecoins into ether, and a system-level exploit rather than a phishing lure — that is the playbook tied to Lazarus Group, the state-backed crew the FBI blamed for the $1.5 billion Bybit heist in February 2025. North Korea-linked hackers stole an estimated $2.02 billion in crypto in 2025 alone. And India has felt this firsthand: the $234.9 million WazirX hack in July 2024, also blamed on Lazarus, left Indian users locked out of their money and pushed the exchange into a court-supervised restructuring.

What This Means If You Trade From India

This isn't a distant story for Indian traders. India has topped Chainalysis' global crypto adoption index for three years running, and Bitget is one of the few offshore exchanges registered with FIU-IND, the financial intelligence unit that polices money laundering. It even paused new Indian sign-ups in February 2026 to comply with updated onboarding rules. So a real slice of India's crypto crowd is watching today's reopening closely.

Here's the uncomfortable part: FIU-IND registration is anti-money-laundering compliance, not deposit insurance. Nothing in Indian law guarantees crypto sitting on any exchange — there's no DICGC-style safety net like bank deposits get. As we reported when Parliament's finance committee wrapped a year of crypto hearings without producing a bill, that protection gap is still wide open.

If you hold funds on Bitget, or any exchange, a few practical moves:

• Withdraw when your asset's phase opens instead of waiting it out — a protection fund is a promise, not a settled payout.
• Expect a wave of phishing. Fake "Bitget refund" pages and DMs appear within hours of any hack, and no exchange will ever ask for your password or 2FA codes.
• Keep long-term holdings in self-custody. Use exchanges as transit stops, not vaults.
• Download your transaction history. India's 30% tax on crypto gains and 1% TDS (tax deducted at source) don't go away because an exchange had a bad week.

Bitget's fund is large enough to make this an ugly week rather than a catastrophe, and so far the exchange is handling it the right way. But protection funds are voluntary, sized by the exchange's own choices. This time the math works. The next breach might land on a platform whose fund doesn't. Until India writes rules with actual investor protection in them, "user funds are safe" is something you're asked to trust — not something you can enforce.