Cryptocurrency exchange Bitget detected unauthorized outflows from its operational transaction systems on September 24, 2026, confirming a devastating Bitget wallet hack that compromised internal server infrastructure. Intruders manipulated transaction authorization protocols to siphon approximately $387.5 million in digital assets across multiple blockchains without stealing private keys, making the breach the largest cryptocurrency theft recorded throughout 2026 [2].
How the Bitget Wallet Hack Bypassed Authorization
Automated monitoring systems at the Seychelles-based trading platform flagged suspicious digital token movements originating from operational storage layers at 18:31 UTC on Thursday, September 24, 2026. While broad consumer perimeter compromises emerge when WaterPlum hackers compromise 30,000 devices in distributed Global Scheme botnets, the Bitget wallet hack bypassed external device vectors entirely to compromise core internal server pipelines directly. Emergency response personnel quickly isolated internal networks to restrict outbound traffic as the intrusion penetrated sections of Bitget’s hot and warm wallet layers across active liquidity channels while engineers worked to preserve offline balances. Cold storage stayed offline. Company leadership clarified that the intrusion strictly compromised the centralized Bitget Exchange, leaving independent consumers utilizing the separate Bitget Wallet non-custodial software application entirely unharmed and protected from unauthorized transfers across all supported mobile platforms [1].
Forensic investigators quickly ruled out any compromise of the cryptographic private keys securing exchange reserves across distributed ledger accounts. Executive Gracy Chen confirmed the security incident on X, disclosing that an unauthorized adversary penetrated backend systems to spoof transaction data. Rather than extracting private keys, the intruders manipulated transaction verification parameters to trick internal authorization pipelines into approving massive treasury releases without raising administrative alarms. Executive Gracy Chen explained that backend server manipulation spoofed transaction records and triggered automated approval routines to disburse exchange assets directly across connected chains [2].
Incident response specialists from Mandiant Incident response and SlowMist Security joined internal engineers to inspect the compromised wallet architecture. Forensic teams traced server instructions [2].
Stolen Digital Tokens Swapped on EVM Chains
Initial assessments published immediately after the intrusion estimated losses at $351.6 million before forensic accountants completed an exhaustive token-by-token inventory. Blockchain analytics platform Lookonchain disclosed the full scope of drained assets, identifying 102.93 million XRP worth approximately $157.48 million as the single largest portion extracted by the attacker during the initial breach. Outflows also included 31,890 ETH valued at $85.75 million, accompanied by stablecoin reserves in USDT, USDC, and USD₮0. The perpetrator also extracted 3,000 units of tokenized gold (XAUt), with BNB, AVAX, and TRX reserves across successive automated withdrawal waves [2].
On-chain monitoring revealed that the adversary moved swiftly to consolidate disparate cryptocurrency tokens through decentralized trading protocols. On-chain tracker Lookonchain reported that the attacker converted the vast majority of proceeds harvested across EVM-compatible chains into 67,982 ETH to simplify laundering. Blockchain intelligence platform Arkham Intelligence identified the recipient addresses and tagged the hacker’s deposit wallets to enable continuous public monitoring across global networks [2].
Platform executives subsequently adjusted Bitget Exchange verified tally upward to approximately $387.5 million following a more thorough audit of wallet transaction logs. Management noted that this adjustment reflected the incorporation of previously omitted Zcash and TRON balances rather than any subsequent theft occurring after defensive teams stabilized exchange infrastructure. The revision represented a fuller accounting of historical transfers executed during the initial security failure before isolation protocols took effect [1].
Forensic Analysis Traces Bitget Crypto Theft to Lazarus
Chief executive Gracy Chen formally linked the Bitget crypto theft to North Korean state-sponsored operators during an extensive live audio discussion conducted on the social media platform X with international community participants. Executive Gracy Chen revealed that investigators traced specific IP addresses back to VPN configurations favored by North Korean state actors. Chen emphasized that attack patterns matched previous campaigns [2]. State-backed cyber operations continue diversifying across global platforms, mirroring tactics where Security Russians posed as Signal technical support with coordinated Iranian campaigns [1].
Blockchain analytics firm Elliptic independently evaluated the cyberattack as highly likely connected to North Korea and DPRK state apparatus based on technical transaction signatures. Forensic specialists discovered direct on-chain connections between XRP extracted from Bitget Exchange and digital assets stolen during an earlier cyber incident attributed to Pyongyang. Stolen Bitget capital also passed through cryptocurrency addresses previously utilized to launder funds extracted during the $1.4 billion Bybit exploit executed in February 2025 as attackers reused established transaction pipelines [2].
MetaMask researcher Taylor Monahan confirmed that stolen Bitget assets flowed into accounts associated with the Bybit attack, attributing the operation to the notorious North Korean military hacking collective known as Lazarus Group. Analyst Taylor Monahan noted that North Korean money launderers demonstrated zero hesitation in utilizing overt cross-protocol fund movements across decentralized bridges. Independent cryptocurrency fraud investigator ZachXBT similarly classified the intrusion as an exploit conducted by DPRK operatives. Officials in Pyongyang rejected international accusations, describing claims of state-backed cryptocurrency theft as a ‘non-existent’ smear campaign manufactured by hostile foreign entities [2].
Bitget User Protection Fund Shields Account Balances
Customer balances remained insulated following the Bitget wallet hack because Bitget maintained a substantial emergency reserve for platform incidents. Executive Gracy Chen assured users that individual account balances were intact and that total platform losses fell entirely within the coverage limits of the company’s dedicated User Protection Fund established to safeguard depositor assets. The User Protection Fund holds 5,500 bitcoin. Because the protection fund is held in physical bitcoin, its aggregate valuation fluctuates above $464 million depending on prevailing market prices, meaning the $387.5 million loss absorbs most available reserves [2].
Exchange administrators temporarily paused user withdrawals to conduct exhaustive integrity checks across critical transaction systems, internal authentication gateways, and ledger databases. Platform services such as deposit processing and spot token trading remained fully operational throughout the containment window. Company officials pledged to publish a comprehensive withdrawal resumption timetable by September 26 at 4:00 AM UTC once security teams verified the integrity of wallet architecture and validated all core ledger systems [1].
Recovery incentives introduced by Executive Gracy Chen offered a 5% reward for voluntarily freezing stolen assets and an additional 5% bounty for returning drained cryptocurrency tokens. Bitget Exchange established a public tracking dashboard and coordinated intelligence submissions through Bybit’s dedicated Lazarusbounty portal to assist international recovery efforts. Stablecoin issuers Circle Internet and Tether Operations swiftly blacklisted approximately $318,000 in combined USDC and USDT held in one flagged wallet address, though most stolen capital remained stored in decentralized ether where centralized asset freezes cannot occur [2].
Surging Exploits Pressure Centralized Exchange Security
Analytics platform DefiLlama ranked the Bitget wallet hack as the largest cryptocurrency exploit of 2026, surpassing all previous decentralized finance and exchange intrusions. Industry reporting from CryptoSlate indicated that the Bitget raid propelled cumulative September theft volumes past the previous record of $651 million documented by Certik across 29 incidents in April. The Drift exploit took 12 minutes. TRM Labs reported that North Korean hacking units have siphoned more than $6 billion in cryptocurrency since 2017, while Elliptic confirmed state-linked heists surpassed $1 billion in 2026 alone [2].
Vulnerability researchers note that artificial intelligence accelerates the discovery of critical software bugs. OpenZeppelin co-founder Manuel Aráoz previously warned that coding agents are superhuman at finding vulnerabilities, counseling industry participants against keeping capital in smart contract protocols. Security teams like Flash Cyber and Wiz Red Agent deploy automated scanners to protect infrastructure, while Canonical shifted Ubuntu kernel schedules to counter relentless CVE floods. Security Microsoft similarly rushed critical patches for enterprise SharePoint zero-day threats [1]. Blockstream Liquid software lost 4,000 bitcoin when software flaws allowed hackers to mint unbacked L-BTC and withdraw roughly $320 million, following a Coldcard Hardware bug that previously exposed over $100 million in bitcoin [2].
A decade into corporate ransomware tracking, security researcher Mikko Hyppönen warned that malicious threat campaigns show no sign of subsiding. Broader tech sectors also evolved defenses, as DEF CON organizer Jeff Moss coordinated Black Hat infrastructure hardening, European provider Acronis drew backing from Security EQT, and developers explored TypeSafe primitives and Project Suncatcher experiments with Kumander Linux [1]. Similarly, whereas incidents like the Gyazo data breach exposed user records and Image Data archives, the Bitget raid bypassed authentication controls to initiate legitimate-looking withdrawals [2]. Exchange operators must now adapt defenses to counter state adversaries manipulating transaction verification pipelines [1].
- ONLINE NEWS Jones, C. (2026, September 25). Bitget blames North Korea for $387.5M crypto wallet raid. The Register. [Article Link]
- ONLINE NEWS Torpey, K. (2026, September 25). North Korea ‘very likely’ behind $388 million hack of crypto exchange Bitget. Gizmodo. [Article Link]
1 comment