Bitget disclosed that attackers moved $351.6 million from parts of its wallet infrastructure on September 24 2026. The exchange said its User Protection Fund, which it claims holds more than $464 million, fully covers the loss.

Incident details

The exchange’s security systems flagged the unusual activity minutes after it began, triggering emergency response protocols. Investigators found that a backend system linked to the wallet infrastructure had been compromised. Rather than extracting private keys, the attackers altered transaction data, causing Bitget’s own authorization mechanisms to release the funds.

Response and protection

Bitget’s chief executive confirmed that cold wallets remained untouched and that the User Protection Fund, stated to exceed $464 million, is sufficient to reimburse the affected amount. While deposits and trading continue without interruption, withdrawals have been paused pending a full security review.

Attribution investigation

During a public livestream, the CEO noted that IP addresses tied to the breach matched VPN services associated with a known North Korean hacking group. She also cited similarities with prior attacks attributed to that region, describing the link as "very likely" but stopping short of confirming it. The exchange has ruled out an internal actor for now, while the inquiry proceeds.

User impact and next steps

Users cannot withdraw funds until the security review concludes, and Bitget has not provided a specific date for resumption. The exchange promised to publish a detailed incident report, including root-cause analysis and remedial steps, within 24 hours of the initial disclosure. Traders are advised to follow official channels for updates.

Why it matters

The episode adds to a series of exchange-related losses this year, underscoring that large reserve figures on a dashboard do not eliminate custodial risk. It highlights the persistent threat posed by sophisticated actors, potentially state-linked, targeting centralized platforms even when trading and deposit services appear unaffected.