Bitget Loses $351.6 Million in Hot Wallet Breach, Rules Out Private Key Compromise

Bitget said attackers moved approximately $351.6 million out of its hot and warm wallets on Sept. 24, the largest breach of a centralised exchange so far this year. Chief executive Gracy Chen said on X that the exchange's cold wallets were unaffected and that the loss is fully covered by the Bitget User Protection Fund, which she put at more than $464 million. Withdrawals have been suspended pending security checks, while deposits and trading remain open.

In a follow-up post on Friday, Chen said the security team had traced the source of the attack. "The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out," she wrote. "Private key compromise has been ruled out." Chen said loss containment was confirmed and no further unauthorised transfers were possible, though the method of intrusion is still under investigation.

Ruling out a key leak narrows the damage, since stolen keys would have left every address they controlled exposed until funds were migrated. What Chen describes instead is a failure of the controls in front of the signer, with Bitget's own authorisation process approving transfers fed to it by a compromised system.

The stolen funds span nine assets, according to a breakdown by onchain tracker Lookonchain. The largest single holding is 102.93 million XRP, worth about $157.5 million, followed by 31,890 ETH ($85.8 million) and roughly $75.5 million across USDT, USDC and USDT0. The rest is made up of 3,000 XAUt, 12,719 BNB, 821,012 AVAX and 20.59 million TRX. At current prices the total comes to about $357 million, slightly above Bitget's own estimate. Blockchain security firm SlowMist has tied the theft to 11 EVM addresses, seven XRP Ledger addresses and one Tron address, and reported that the attacker has been converting EVM-chain assets into ETH.

No formal attribution has been published. Chen said during a livestream that some IP addresses used in the attack closely matched VPN patterns associated with a North Korea-linked group, while stressing the attackers' identity was not confirmed. Onchain investigator Specter separately linked the routing of the stolen XRP to funds from July's roughly $24 million hack of AFX.

Bitget said in a separate statement that the protection fund holds 5,500 BTC, with its addresses publicly verifiable, and that the loss will be covered "after assessment" before the fund is replenished. The payout would consume about three-quarters of the fund, and because the reserve is held in Bitcoin, its dollar value will move with the BTC price until the claim is settled. Bitget has said further details on coverage terms will follow.

Bitget's exchange token BGB was trading at $2.04, down about 3% over 24 hours, according to CoinMarketCap. The breach comes in the same month as a roughly $320 million loss at Liquid Network, making September the costliest month for crypto hacks in 2026.

Chen has promised a full technical report once the investigation is complete. Bitget has not given a date for reopening withdrawals, and Chen said the exchange "will not commit to a window we cannot guarantee."