Bitget Hacked: $350M+ Drained From Hot Wallets as XRP, ETH and Stablecoins Vanish
September 25, 2026
Bitget, one of the world’s largest centralized crypto exchanges, confirmed a major security breach after unauthorized transfers swept through part of its wallet stack on September 24, 2026. The exchange says about $351.6 million was affected. On-chain monitors later put the visible haul closer to $357 million.
Withdrawals are paused. Deposits and trading remain open. Bitget says customer balances were not rewritten and that a User Protection Fund holding more than $464 million covers the loss.
That official line is now colliding with a harder on-chain picture: a multi-chain drain, a fast conversion of freezeable stablecoins into ETH, and a surprisingly large XRP pile that early trackers almost missed.
At 18:31 UTC on September 24, 2026, Bitget’s security systems flagged unauthorized transfers from some hot wallets. Emergency protocols went live within minutes.
CEO Gracy Chen later said the breach hit part of Bitget’s hot and warm wallet layers. The exchange uses a three-tier setup: hot, warm, and cold. Bitget says cold wallets remain fully secure.
The first public signal did not come from the exchange. On-chain watchers saw labeled Bitget wallets sending assets to a fresh address later tagged on Etherscan as Bitget Exploiter 1. Early estimates sat around $170–$192 million. Those figures were incomplete. They captured a large EVM-side drain and missed most of the XRP.
Bitget’s own accounting landed at $351.6 million. Lookonchain’s later inventory put the stolen basket near $356.86 million.
Stolen Basket
Lookonchain’s breakdown of funds taken from Bitget:
| Asset | Amount | Approx. USD value |
|---|---|---|
| XRP | 102.93 million | $157.48 million |
| ETH | 31,890 | $85.75 million |
| USDT | 34.75 million | $34.75 million |
| USDC | 21.05 million | $21.05 million |
| USD₮0 | 19.67 million | $19.67 million |
| XAUt | 3,000 | $12.82 million |
| BNB | 12,719 | $9.88 million |
| AVAX | 821,012 | $8.38 million |
| TRX | 20.59 million | $7.07 million |
| Total | — | ~$356.86 million |
XRP is the single largest line item. ETH is second. Together they make up most of the theft. The rest is a mix of dollar stablecoins, Tether Gold, BNB, Avalanche, and Tron.
That composition matters. Issuers can try to freeze USDT and USDC. They cannot freeze ETH the same way. Attackers understood the difference.
How the Money Moved
The on-chain sequence was fast and coordinated.
One of the first loud moves: a new wallet beginning 0xe410 took about 19.67 million USDT0 from a Bitget-labeled hot wallet on Arbitrum and bought roughly 7,111 ETH in about six minutes. The route ran through UniswapX and 1inch Fusion. Some fills printed as much as 5% above spot.
More transfers followed across Ethereum, Arbitrum, BNB Chain, Avalanche, Tron, and the XRP Ledger. Assets consolidated into fresh wallets. Stablecoins were swapped into ETH. Bridges such as Stargate and Celer’s cBridge appeared in the trail.
Lookonchain later said the attacker had already converted most stolen EVM-chain funds into about 67,982 ETH, worth roughly $183 million at the time of that snapshot. The XRP stack stayed large: about 102.9 million XRP, still worth around $157 million.
Early public tallies looked smaller because XRP does not live on the same explorers as ETH and USDT. Two XRP Ledger wallets labeled as Bitget’s sent tens of millions of XRP during the same window as the Ethereum outflows. Once those transfers were counted, the story jumped from a ~$180 million incident to a ~$350 million one.
How Bitget Says the Attack Worked
This does not look like a simple private-key smash-and-grab.
Chen said investigators found that attackers breached a critical backend system inside Bitget’s wallet service, forged transfer data, and then triggered the exchange’s normal authorized signing process. In other words: the thieves allegedly changed the payment details inside the machine, then let Bitget’s own approval flow send the coins out.
Bitget says:
- private keys for hot and cold wallets were not leaked
- attackers did not fake ordinary user withdrawal requests
- an insider job is unlikely on current evidence
- further outflows have been stopped
Later comments from Chen pointed to a possible supply-chain angle: a third-party tool used by Bitget may have been compromised, and that tool then touched a key wallet-backend system. The exact entry point is still under technical review. Bitget promised a full incident report with root-cause analysis.
Treat the attack-path details as preliminary until that report is out.
Who Is Being Blamed?
Attribution is moving fast and is not final.
Chen said some related IP addresses match VPN patterns used by a North Korean hacking group, and that the operating style resembles previous DPRK-linked jobs. She has pointed toward Lazarus Group, while stressing the identity is not confirmed.
On-chain detective work has added fuel. Analysts tracking the stolen XRP say part of the trail connects to funds from the earlier AFX hack, a roughly $24 million incident attributed to TraderTraitor, a cluster linked to Lazarus.
The playbook also rhymes with other large exchange thefts: hit operational wallet infrastructure, move across several chains at once, dump freezeable paper for ETH, then scatter.
None of that is a courtroom verdict. It is the working theory as of September 25.
What Bitget Is Telling Users
From the official security notice:
- estimated funds affected: ~$351.6 million
- cold wallets: fully secure, per Bitget
- User Protection Fund: over $464 million, later described as above $465 million
- account balances: accurate
- deposits and trading: still live
- withdrawals: paused until the security review is done
- law enforcement and on-chain security firms: notified and engaged
Chen also said Bitget holds more than $1 billion in its own capital and compared the firm’s ability to absorb the hit with Bybit’s survival of a $1.5 billion hack in 2025. She rejected FTX comparisons and said customer funds were not being misused.
Those claims are Bitget’s. The fund’s exact asset mix has not been independently audited in public as of this writing. The next real test is simple: when withdrawals reopen, can users leave without a queue turning into a run?
Why This One Stings
September was already a brutal month for crypto exploits. Adding Bitget’s figure pushes reported September thefts above $684 million, which would make it the costliest month of 2026 so far, ahead of April’s roughly $647 million.
The incident also lands just days before Bitget’s 8th anniversary.
The deeper issue is architectural. Hot wallets exist because exchanges need liquidity on tap. Warm wallets sit in the middle. Cold storage is the vault. Attackers did not need the vault if they could poison the system that tells the vault’s neighbors where to send money.
That is the uncomfortable lesson. Multisig and offline keys are not enough if the instruction layer can be forged.
For XRP holders, the size of the stolen stack is its own risk. More than 100 million XRP sitting with an attacker can become sell pressure, mix through new wallets, or both. For ETH, the conversion strategy already concentrated a large slice of the loot into a harder-to-seize asset.
Timeline
- 18:31 UTC, Sept. 24, 2026 — Bitget detects unauthorized hot-wallet transfers.
- Minutes later — emergency response starts.
- ~18:31–20:55 UTC — on-chain outflows visible across multiple networks.
- Early window — ~$19.67M USDT0 swapped into ~7,111 ETH on Arbitrum.
- Same window — large USDT, USDC, XAUt, ETH, BNB, AVAX, TRX and XRP movements.
- ~21:30 UTC — Chen posts the public security notice. Official site publishes the same.
- Withdrawals frozen. Trading stays up.
- Sept. 25 — Lookonchain publishes the ~$357M asset list. Chen says private-key leakage is ruled out and points to a backend/supply-chain path. North Korea remains the leading suspected source, not a confirmed one.
What Users Should Do
If you hold funds on Bitget:
- Treat the official channels as the only source for withdrawal-reopen times.
- Remember deposits still work. That does not mean you should send more capital into a paused venue.
- Screenshot balances and recent history.
- Wait for the promised incident report before accepting any final story about “how it happened.”
- If you withdraw later, test with a small amount first.
If you do not hold funds there, the lesson is older than this hack: exchange balance is an IOU. Insurance funds help. They are not the same thing as coins in a wallet you control.
Bottom Line
Bitget was hit. The exchange says $351.6 million. On-chain tallies say closer to $357 million, led by 102.93 million XRP and 31,890 ETH, plus a stack of stablecoins, tokenized gold, BNB, AVAX and TRX.
Bitget says users will be made whole from a protection fund larger than the loss, cold wallets never fell, and the attackers faked transfer instructions instead of stealing keys. Investigators are chasing a backend breach, possibly through a third-party tool, and a North Korean fingerprint that has not been proven in public.
The coins are already gone from the hot side. The argument now is whether the fund, the forensics, and the withdrawal queue can keep the rest of the story from becoming another exchange-crisis spiral.
This is a developing incident. Figures can move as more wallets are labeled and as Bitget’s full report lands.
Sources: Bitget official security notice (Sept. 24, 2026); statements by CEO Gracy Chen; Lookonchain asset inventory; reporting and on-chain notes from Bloomberg, The Block, CoinDesk, Unchained, CryptoSlate, Wu Blockchain, Arkham/Bubblemaps coverage, and subsequent CEO remarks on the attack path.