Key Takeaways
- • Bitget confirmed a $387.5 million theft from its exchange wallets on September 24, 2026, making it one of the largest crypto exchange security breaches in recent history, with CEO Gracy Chen stating North Korea is "very likely" responsible for the attack.
- • Attackers bypassed Bitget's signing controls through fraudulent approvals, gaining access to both hot and warm wallet systems while cold storage remained secure; unauthorized transfers were detected at 18:31 UTC with emergency procedures activated within minutes.
- • Circle and Tether froze approximately $318,000 in stablecoins linked to stolen funds on September 25, though the majority of assets had already moved through multiple wallets before freezing could take effect.
- • Bitget's protection fund covers the full loss, and the exchange announced a phased withdrawal resumption beginning September 28, starting with Bitcoin, assuring users that customer assets remain protected despite the hot-wallet compromise.
- • Forensic investigations by Mandiant and SlowMist are ongoing to determine the initial entry point and full scope of the breach, while analysts observed stolen funds being rapidly converted to ETH at prices up to 5% above market rates within minutes of the theft.
Summary
Bitget, a major cryptocurrency exchange, suffered a significant security breach on September 24, 2026, resulting in the theft of $387.5 million in digital assets from its operational wallets. The attack represents a major incident in crypto exchange security, with CEO Gracy Chen publicly stating that North Korean actors are "very likely" responsible for the theft. The company's security systems detected unauthorized transfers at 18:31 UTC and initiated emergency procedures within minutes, limiting the damage to hot and warm wallet systems while preserving offline cold storage reserves.
The attack methodology relied on fraudulent approvals that circumvented Bitget's signing controls, rather than conventional private key theft. This sophisticated approach allowed attackers to bypass multiple layers of security infrastructure. According to forensic observations, attackers rapidly converted a portion of stolen assets almost immediately following the breach—analyst DCF GOD identified a fresh wallet spending $19.67 million in USDT to purchase 7,111 ETH within six minutes, reportedly paying as much as 5% above market prices to expedite the transaction. This swift asset movement complicated recovery efforts and indicated coordinated, professional execution of the theft.
In response to the breach, stablecoin issuers Circle and Tether implemented protective measures on September 25, freezing approximately $318,000 in stablecoins associated with the stolen funds. However, the majority of the $387.5 million had already been moved through multiple wallets before these freezes could take effect, limiting the effectiveness of post-breach containment. Bitget disclosed that its protection fund covers the full loss, protecting customer assets despite the compromise of the exchange's operational wallets.
Bitget announced a phased withdrawal resumption beginning September 28, with Bitcoin withdrawals resuming first, followed by additional assets in subsequent phases. The company assured customers that user funds remain protected and that the breach affected only operational wallet systems, not customer holdings. Mandiant and SlowMist are conducting ongoing forensic investigations to establish the precise initial entry point and determine whether additional vulnerabilities exist. The initial vector of attacker access remains undisclosed pending completion of the investigation.
The attack methodology relied on fraudulent approvals that circumvented Bitget's signing controls, rather than conventional private key theft. This sophisticated approach allowed attackers to bypass multiple layers of security infrastructure. According to forensic observations, attackers rapidly converted a portion of stolen assets almost immediately following the breach—analyst DCF GOD identified a fresh wallet spending $19.67 million in USDT to purchase 7,111 ETH within six minutes, reportedly paying as much as 5% above market prices to expedite the transaction. This swift asset movement complicated recovery efforts and indicated coordinated, professional execution of the theft.
In response to the breach, stablecoin issuers Circle and Tether implemented protective measures on September 25, freezing approximately $318,000 in stablecoins associated with the stolen funds. However, the majority of the $387.5 million had already been moved through multiple wallets before these freezes could take effect, limiting the effectiveness of post-breach containment. Bitget disclosed that its protection fund covers the full loss, protecting customer assets despite the compromise of the exchange's operational wallets.
Bitget announced a phased withdrawal resumption beginning September 28, with Bitcoin withdrawals resuming first, followed by additional assets in subsequent phases. The company assured customers that user funds remain protected and that the breach affected only operational wallet systems, not customer holdings. Mandiant and SlowMist are conducting ongoing forensic investigations to establish the precise initial entry point and determine whether additional vulnerabilities exist. The initial vector of attacker access remains undisclosed pending completion of the investigation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.