Yesterday, one of the cryptocurrency industry’s largest security incidents of the year unfolded at Bitget, a major global crypto exchange.
What initially appeared to be an incident involving approximately $351.6 million in unauthorized transfers became even more serious as blockchain investigators traced additional movements. The estimated amount eventually rose to around $387.5 million.
The incident raised an uncomfortable question for millions of cryptocurrency investors: if a major exchange with dedicated security teams and sophisticated infrastructure can suffer losses of this scale, how safe are the digital assets held on centralized trading platforms?
The story was not simply about hackers stealing cryptocurrency. It exposed the risks hidden inside the systems that exchanges use to authorize withdrawals, manage liquidity and protect customer funds.
And perhaps the most disturbing detail was that, according to Bitget’s initial explanation, the attackers did not need to steal the exchange’s private keys.
They allegedly found another way to make the platform’s own authorization infrastructure approve fraudulent transfers.
What Happened at Bitget on September 24?
Bitget detected unauthorized transfers from some of its wallets on September 24, 2026.
The exchange said its reconciliation systems identified suspicious activity and activated its emergency response procedures. Withdrawals were temporarily suspended while the security team investigated the incident.
The initial estimate was approximately $351.6 million in affected cryptocurrency.
However, subsequent blockchain analysis identified additional assets and transfers that had not been included in the first estimate. On September 25, the reported amount was revised to approximately $387.5 million.
This distinction matters: the higher figure did not necessarily represent a second attack or another wave of theft. It reflected a more complete assessment of the transfers associated with the original incident.
The breach affected parts of Bitget’s hot and warm wallet infrastructure. The company said its cold wallets remained secure and that its separate self-custodial Bitget Wallet product was not affected.
The exchange also announced that its User Protection Fund, which held more than $464 million at the time of the initial announcement, would cover the reported losses.
For customers, this was an important reassurance. But the incident still demonstrated how quickly a security failure can put hundreds of millions of dollars at risk.
The Most Alarming Detail: Hackers Allegedly Bypassed the Normal Security Process
The technical explanation provided by Bitget’s CEO, Gracy Chen, made the incident particularly concerning.
According to the company’s account, the attackers compromised a critical backend system connected to its wallet infrastructure. They allegedly manipulated transaction information and triggered the exchange’s authorization process to approve transfers that should never have been authorized.
In other words, the problem was not necessarily that someone had obtained the secret keys controlling the funds.
It was that the systems responsible for preparing and approving transactions were allegedly manipulated into treating fraudulent instructions as legitimate.
This is an important distinction.
Cryptocurrency security is often discussed in terms of private keys, passwords, seed phrases and hardware wallets. These are essential elements, but they are not the entire security picture.
A large exchange operates a complex technological environment involving databases, transaction-monitoring systems, internal permissions, software interfaces and automated approval procedures.
If an attacker gains control of a critical component in that chain, the consequences can be severe even when the private keys themselves remain protected.
The Bitget incident therefore highlighted a broader weakness: protecting the keys is not enough if the infrastructure that decides when and where those keys are used can be compromised.
Hot Wallets, Warm Wallets and Cold Storage: Where Was the Risk?
To understand the scale of the incident, it is useful to understand how cryptocurrency exchanges generally organize their digital assets.
Most large platforms do not keep all their cryptocurrency in a single wallet. They use different storage systems depending on how quickly funds need to be accessed.
Hot Wallets
Hot wallets are connected to internet-accessible systems and are used to process deposits, withdrawals and other transactions.
They are convenient because they allow exchanges to serve customers quickly.
However, their connection to operational infrastructure also creates a larger potential attack surface.
Warm Wallets
Warm wallets occupy an intermediate position. They are used to manage liquidity between operational wallets and more secure storage arrangements.
Their exact architecture varies between platforms, but they can provide an additional layer of separation from the systems handling everyday transactions.
Cold Wallets
Cold wallets are designed to keep critical signing infrastructure offline or isolated from internet-connected systems.
They are generally considered a safer way to store large cryptocurrency reserves because they reduce exposure to remote attacks.
Bitget stated that its cold wallets were not affected by the September incident.
However, the breach demonstrated that even a limited compromise of hot and warm wallet infrastructure can produce enormous financial losses.
The lesson is straightforward: an exchange’s security cannot be judged simply by how much cryptocurrency it keeps offline. The systems connecting storage, transaction preparation and authorization matter just as much.
Was North Korea Behind the Bitget Attack?
Another major question emerged almost immediately: who was responsible?
Bitget’s CEO indicated that North Korean involvement was considered very likely, pointing to IP behavior and blockchain transaction patterns that allegedly resembled activity associated with previously identified hacking groups.
Blockchain intelligence company TRM Labs also identified connections between the movement of funds and laundering networks associated with previous North Korean-linked cryptocurrency thefts.
However, there is an important distinction between identifying similarities and proving responsibility.
TRM Labs described the evidence as pointing toward possible North Korean involvement but did not present a definitive attribution of the Bitget attack.
That caution matters because cryptocurrency thefts frequently involve multiple stages: the initial intrusion, the movement of stolen assets, the use of intermediary wallets and attempts to exchange or conceal the funds.
Investigators may identify connections between those stages without being able to establish conclusively who carried out the original intrusion.
North Korean-linked cyber operations have been associated with several major cryptocurrency thefts in recent years, making the possibility particularly concerning for exchanges and blockchain companies.
But until stronger evidence is published, the Bitget incident should not be presented as a definitively confirmed North Korean operation.
Where Did the Stolen Cryptocurrency Go?
Following the attack, blockchain investigators tracked movements across several networks, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base.
TRM Labs reported that the stolen assets were moved through multiple addresses and divided into smaller amounts.
Some funds were routed through cross-chain services and decentralized swapping infrastructure, making the investigation more complicated.
This is one of the biggest challenges facing cryptocurrency investigators.
Blockchain transactions are publicly visible, but identifying the real-world person controlling a wallet is a different matter. Attackers can move funds between networks, create new addresses and use different services in an attempt to make tracing more difficult.
Even when investigators can follow the money, freezing or recovering the assets is not always possible.
The Bitget case once again demonstrated both sides of blockchain transparency: transactions can be monitored in remarkable detail, but that does not automatically mean stolen funds can be recovered.
Bitget Promised to Cover the Losses
One of the most important announcements after the incident concerned the exchange’s User Protection Fund.
Bitget said the fund held more than $464 million and would cover the losses associated with the breach.
This was a significant part of the company’s response because the reported amount eventually reached approximately $387.5 million.
The existence of a protection fund can provide an additional financial buffer when an exchange experiences a major security incident.
However, investors should not assume that every cryptocurrency platform has a comparable reserve or that every protection mechanism offers identical guarantees.
A fund’s value, the assets it contains, its legal structure and the conditions under which it can be used all matter.
There is also a difference between an exchange announcing that it will cover a loss and customers actually receiving compensation.
For that reason, investors should look for transparent information about how compensation is implemented, whether balances remain available and whether withdrawals have returned to normal.
Bitget’s announcement was reassuring, but the long-term credibility of any protection fund ultimately depends on its ability to deliver when customers need it.
Why This Attack Matters Beyond Bitget
The Bitget incident was not an isolated reminder that cryptocurrency platforms can be hacked. It highlighted a problem that affects the entire centralized exchange model.
Millions of people use exchanges because they offer convenience. They provide trading interfaces, custody services, fiat payment options and access to hundreds of digital assets.
But when customers leave cryptocurrency on a centralized platform, they are relying on that company to protect the infrastructure controlling their assets.
That creates a fundamental trade-off.
Self-custody gives investors greater direct control over their cryptocurrency, but also makes them responsible for protecting their own keys and recovery phrases.
Centralized exchanges offer convenience and operational support, but customers depend on the platform’s internal security, financial resilience and response procedures.
The Bitget incident shows that neither model is completely free of risk.
For exchanges, the challenge is no longer simply preventing outsiders from stealing private keys. Security systems must also protect internal software, transaction data, employee permissions and automated authorization procedures.
Independent audits, strict access controls, transaction limits, real-time monitoring and isolated signing environments are all important parts of that effort.
The industry will need to pay closer attention to the entire transaction process rather than focusing exclusively on the wallets where cryptocurrency is stored.
What Should Cryptocurrency Investors Do After the Bitget Hack?
The incident offers several practical lessons for anyone holding digital assets.
1. Avoid Keeping All Your Cryptocurrency on One Exchange
A trading platform can be useful for buying and selling, but it does not have to be the permanent home for your entire portfolio.
2. Consider Self-Custody for Long-Term Holdings
Hardware wallets and other self-custody solutions can reduce dependence on a centralized exchange. However, they introduce their own responsibilities: losing a recovery phrase can mean losing access permanently.
3. Check the Exchange’s Protection Arrangements
Look beyond marketing claims. Investigate whether the platform publishes information about its reserves, security practices and customer protection mechanisms.
4. Enable Additional Account Protections
Use strong, unique passwords, multi-factor authentication and withdrawal allowlists where available. These measures cannot prevent every infrastructure-level attack, but they can reduce other common risks.
5. Pay Attention to Withdrawal Announcements
When an exchange suspends withdrawals, do not rely exclusively on social media speculation. Follow official announcements and independent reporting to understand what has happened.
6. Be Careful with Recovery Scams
After major cryptocurrency thefts, scammers often contact affected users pretending to be investigators, exchange employees or recovery specialists. Never share passwords, private keys or seed phrases with anyone claiming they can recover stolen funds.
Is the Era of Trusting Crypto Exchanges Coming to an End?
Probably not. Centralized exchanges remain an important part of the cryptocurrency ecosystem, and incidents like this do not automatically mean that every platform is unsafe.
However, the Bitget breach reinforces an increasingly important reality: the reputation of an exchange is not a substitute for technical security.
A platform can have millions of customers, substantial reserves and a sophisticated infrastructure and still suffer a major incident.
The industry also needs to move beyond the idea that keeping private keys secure is enough. Transaction authorization systems, internal software and operational processes must be protected with the same level of attention.
For investors, the message is equally clear. Choosing where to store cryptocurrency is a security decision, not simply a question of trading fees or the number of available coins.
The September 2026 Bitget hack will be remembered as one of the year’s most significant exchange security incidents. Its final financial impact was estimated at approximately $387.5 million, and its technical implications extend far beyond one company.
The next major crypto security failure may not involve someone stealing a private key at all. It could involve manipulating the systems that are supposed to decide whether a transaction is legitimate.
And that may be the most important lesson this incident has left behind.
Sources and Further Reading
- Reuters — September 25, 2026: Crypto exchange Bitget pauses withdrawals after $350 million stolen in hack
- TRM Labs — September 25, 2026: Bitget Loses USD 351.6 Million in Hot Wallet Breach
- CoinDesk — September 25, 2026: Bitget’s $352 Million Hack Happened via Spoofed Transfers
- The Block — September 24–25, 2026: Bitget Confirms $387.5 Million Security Breach
- Bitget — September 24, 2026: Official Security Notice
This article is for informational purposes only and does not constitute investment advice.
