Bitget’s security systems flagged unauthorized transfers from a slice of its hot and warm wallet infrastructure at about 18:31 UTC on September 24, 2026. Trading and deposits kept running. Withdrawals paused. User account balances, Bitget says, were not touched — and the hit sits inside the exchange’s User Protection Fund.
An early affected-assets mark of roughly $351.6 million was revised on September 25 to about $387.5 million after fuller classification, including additional Zcash and TRON transfers. Bitget frames that revision as accounting of the original incident, not new post-containment drains. Treat ~$387.5M as the exchange’s current revised estimate — it may still move as investigators finish the ledger.
Desk coverage lines up across Bitget’s own academy timeline, Decrypt (Sep 25), TokenPost (Sep 26), and CoinNews on the phased withdrawal restart.
Attack Path: Backend Spoof, Not Stolen Keys
Bitget’s stated path is blunt: an attacker compromised a critical backend inside wallet infrastructure, spoofed transaction data, and rode the exchange’s own authorization process. Private-key compromise has been ruled out. Cold wallets were not affected. Bitget Wallet — the non-custodial product — was not in scope.
That distinction matters more than the headline number. Hot and warm wallets are the operational layer exchanges use to move customer assets quickly. Spoofed inputs into the signing path turn “the keys never left the vault” into a weaker comfort when the systems that decide what those keys sign are the ones that failed. Custody theatre that stops at key storage misses the authorization pipeline sitting in front of it.
Confirmed affected assets, per Bitget and TokenPost, include ETH, XRP, BNB, ZEC, USDT, USDC, USDT0, XAUt, AVAX, TRX and related network variants. Unauthorized transfers spanned Ethereum and several EVM networks, the XRP Ledger, Zcash, and TRON. Decrypt reports the single largest piece as roughly 103 million XRP — about $157 million. Pre-confirm on-chain sleuthing cited by Decrypt also includes a wallet that spent $19.67 million in USDT0 to buy 7,111 ETH in six minutes (DCF GOD via Decrypt).
Response, Fund Cover, and Investigation
Withdrawals were paused after detection. Trading and deposits continued. Bitget says user balances remain unaffected and the financial impact falls within its User Protection Fund. Decrypt reported the fund held more than $464 million at the time — cite that as reported size context, not a freeze or recovery total. Bitget has said some affected assets were “successfully frozen” via industry partners; it has not published a verified aggregate freeze figure in the academy piece, so no invented dollar totals belong here.
On September 25, Bitget says the attack path was identified and the underlying vulnerability remediated. External help includes Mandiant and SlowMist. A Recovery Bounty Program went up for returned funds. Law enforcement and financial-intelligence units were notified. TokenPost’s Sep 26 frame matches the cold-wallet-intact / deposits-and-trading-operational line Bitget has held since detection.
CEO Gracy Chen has said IP and on-chain patterns resemble prior North Korea–linked techniques. Decrypt and CoinNews both stress that attribution is not confirmed and the investigation remains open. Treat DPRK / Lazarus language as CEO suspicion and pattern match only — not a closed case.
Phased Withdrawals From Sep 28 UTC
On September 26, Bitget published a four-phase withdrawal restart (CoinNews notes the support-center schedule around 03:55 UTC Sep 26). Stated windows are all 08:00 UTC:
September 28 — BTC on the Bitcoin network.
September 29 — ETH on Ethereum, BSC, Arbitrum, Base, and Optimism.
September 30 — USDT on Ethereum, BSC, Solana, and Tron.
October 2 — other tokens, fiat, and P2P.
CoinNews notes that assets in the attack but absent from the first three phases — including XRP, Zcash, TRON, and Avalanche — fall under the October 2 window. These dates are Bitget’s stated plan, not independently confirmed completed reopenings at research time. If phases slip after publish, treat the schedule as the exchange’s published intent until reopenings are verified.
Jamoraquai Take
When an exchange loses hundreds of millions without a private-key leak — because a compromised backend fed spoofed transaction data into its own signing path — the lesson is that “keys are safe” is not the same as “the systems that decide what those keys sign are safe.”
The useful read is operational. Bitget’s revised ~$387.5M mark, the Sep 24 detection, cold-wallet integrity, Protection Fund cover, Mandiant/SlowMist engagement, and the Sep 28–Oct 2 withdrawal phases are one incident timeline. The failure mode Bitget describes is authorization integrity upstream of the key — not a vault door left open. Keep CEO pattern-match language about North Korea as suspicion, not attribution. None of this is a buy, sell, or exit call on BGB, Bitget, or any asset on the affected list.
Sources: Bitget Academy · Decrypt · TokenPost · CoinNews
