Key Takeaways
- • Bitget suffered a $387.5 million security breach on September 25, 2026, making it the largest cryptocurrency hack of the year, with attackers exploiting a wallet backend vulnerability to spoof legitimate transactions and bypass internal authorization systems.
- • The attack drained crypto assets from Bitget's hot and warm wallets (company-controlled liquidity pools), but did not compromise private keys or affect Bitget Wallet, the platform's separate self-custodial product where users retain direct control of their assets.
- • CEO Gracy Chen identified North Korean-linked attackers as the primary suspect, citing the exploitation method and scale consistent with known state-sponsored crypto theft operations used to generate hard currency amid international sanctions.
- • Bitget paused withdrawals immediately following the breach, subsequently resumed Bitcoin withdrawals, and processed 4,098 BTC across 9,585 withdrawal orders; BGB, the exchange's native token, declined 7% to $1.93 before partially recovering to $1.97.
- • The incident underscores systemic exchange infrastructure vulnerabilities despite Bitcoin's underlying protocol security; North Korean hackers stole a record $2 billion in cryptocurrency across 2025, establishing a persistent threat pattern to centralized platforms.
Summary
Bitget, one of the world's major cryptocurrency exchanges, fell victim to a $387.5 million hack on September 25, 2026, representing the largest cryptocurrency theft of the year and intensifying scrutiny of institutional-grade security practices across centralized trading platforms. The attack exploited vulnerabilities in Bitget's wallet backend systems, allowing threat actors to spoof transaction data and manipulate the exchange's internal approval mechanisms into authorizing fraudulent withdrawals without obtaining the private keys required to move customer assets. During a three-hour livestream on X, CEO Gracy Chen disclosed the technical nature of the breach and outlined the company's immediate containment response.
The compromised assets were limited to Bitget's hot and warm wallets—operational cryptocurrency pools maintained by the exchange to facilitate customer trades and withdrawals. Bitget Wallet, a separate self-custodial product where users retain direct ownership and control of their digital assets, remained uncompromised. Chen attributed the attack to North Korean-linked threat actors, a designation consistent with established patterns of state-sponsored crypto theft operations. North Korean hackers accumulated a record $2 billion in stolen cryptocurrency during 2025, according to blockchain analytics firm Chainalysis, leveraging such thefts as a primary mechanism to generate foreign currency and circumvent international sanctions that restrict conventional banking and investment channels.
Following the breach discovery, Bitget immediately suspended withdrawals platform-wide while conducting security audits. The company subsequently resumed Bitcoin withdrawals, processing 4,098 BTC across 9,585 withdrawal orders as it methodically restored access to other asset classes. The revised loss estimate of $387.5 million incorporated additional transactions identified on privacy-focused networks including Zcash and TRON, which functions as a primary infrastructure for stablecoin transfers. Bitget reported that the vulnerability has been patched and security infrastructure strengthened; however, the incident sparked immediate market reaction, with BGB, the exchange's native token, declining 7 percent to $1.93 before recovering modestly to $1.97.
The breach tests institutional confidence in centralized crypto platforms despite remaining orthogonal to Bitcoin's core protocol security. While Bitcoin's decentralized consensus mechanism and cryptographic architecture remain uncompromised, the attack illustrates the persistent vulnerability of centralized custodial infrastructure. For institutional investors and family offices evaluating cryptocurrency exposure, the incident reinforces the distinction between protocol-layer security risks and counterparty risks inherent to exchange platforms, particularly regarding backend systems, authorization workflows, and operational security practices.
The compromised assets were limited to Bitget's hot and warm wallets—operational cryptocurrency pools maintained by the exchange to facilitate customer trades and withdrawals. Bitget Wallet, a separate self-custodial product where users retain direct ownership and control of their digital assets, remained uncompromised. Chen attributed the attack to North Korean-linked threat actors, a designation consistent with established patterns of state-sponsored crypto theft operations. North Korean hackers accumulated a record $2 billion in stolen cryptocurrency during 2025, according to blockchain analytics firm Chainalysis, leveraging such thefts as a primary mechanism to generate foreign currency and circumvent international sanctions that restrict conventional banking and investment channels.
Following the breach discovery, Bitget immediately suspended withdrawals platform-wide while conducting security audits. The company subsequently resumed Bitcoin withdrawals, processing 4,098 BTC across 9,585 withdrawal orders as it methodically restored access to other asset classes. The revised loss estimate of $387.5 million incorporated additional transactions identified on privacy-focused networks including Zcash and TRON, which functions as a primary infrastructure for stablecoin transfers. Bitget reported that the vulnerability has been patched and security infrastructure strengthened; however, the incident sparked immediate market reaction, with BGB, the exchange's native token, declining 7 percent to $1.93 before recovering modestly to $1.97.
The breach tests institutional confidence in centralized crypto platforms despite remaining orthogonal to Bitcoin's core protocol security. While Bitcoin's decentralized consensus mechanism and cryptographic architecture remain uncompromised, the attack illustrates the persistent vulnerability of centralized custodial infrastructure. For institutional investors and family offices evaluating cryptocurrency exposure, the incident reinforces the distinction between protocol-layer security risks and counterparty risks inherent to exchange platforms, particularly regarding backend systems, authorization workflows, and operational security practices.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.