Bitget Covers $351.6 Million as Stolen Coins Keep Moving

Bitget said attackers moved about $351.6 million out of its hot and warm wallets on September 24, 2026, in the largest crypto theft of 2026 so far. The exchange says a User Protection Fund of more than $464 million covers the hole, and that customer balances still add up. Withdrawals are paused anyway.

The coins are already moving. On-chain firms watched stablecoins and tokenized gold get sold for ether within minutes, a path U.S. officials describe as how North Korea turns stolen crypto into cash for weapons work. Bitget can refill a ledger. It cannot call the tokens back.

Bitget Can Cover the Loss on Paper

Bitget’s support desk said its systems detected unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24. The company put the hit at about $351.6 million and said the loss sits inside a three-tier wallet setup, with only part of the hot and warm layers touched. Cold wallets, it said, remain fully secure.

That $351.6 million is about three-quarters of the protection fund Bitget put at more than $464 million. The fund is how the firm can say balances are still right while the actual tokens are gone. Deposits and trading stayed open. The self-custody Bitget Wallet, which the company says runs on separate systems, was not part of the incident.

A covered balance is not cash you can move. Until the security review ends, users can see numbers on a screen they cannot send to another address. Chief executive Gracy Chen said teams are fixing systems and preparing to reopen withdrawals together, and that Bitget “will not commit to a window we cannot guarantee.”

At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limited number of hot wallets.

Our security team immediately activated emergency response procedures and began a full investigation.

Based on our current assessment,… https://t.co/7xF5xW0JQ1

— Bitget (@bitget) September 24, 2026

A Compromised Backend Triggered Bitget’s Own Transfers

Chen’s Friday update narrowed the failure. The attacker did not walk out with the private keys that control the wallets. A backend system inside the wallet stack was used to feed fake transfer data into Bitget’s own approval flow, which then signed the moves.

The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. Private key compromise has been ruled out.

Gracy Chen, chief executive, Bitget, on X

Stolen keys would have left every address they controlled open until funds were moved. What Chen describes is a hole in front of the signer: Bitget’s process approved transfers a compromised system put in front of it. She said further unauthorized transfers had been stopped. The first break-in method, she said, is still under review, with a full technical report promised after that work ends.

Chen also said the method was “highly consistent with known patterns of North Korean hacker organizations,” citing IP behavior and on-chain analysis, while stopping short of a firm attribution. Bitget hired Mandiant and SlowMist for the inquiry and said it had notified authorities and flagged the receiving addresses.

WHAT WE KNOW

• The loss: Bitget estimates about $351.6 million left hot and warm wallets on September 24.
• The reserve: The User Protection Fund is stated at more than $464 million, larger than that estimate.
• The freeze: Withdrawals are paused; deposits and trading remain open.
• The keys: Chen said private keys were not taken and that further unauthorized transfers have been stopped.

WHAT IS UNCONFIRMED

• The actor: North Korea is suspected from patterns and IP clues; Bitget has not published a formal attribution.
• The clock: No date has been set for withdrawals to resume.
• The entry point: How the backend was first reached is still under investigation.
• The freeze on-chain: Some networks have been asked to hold tainted wallets; how much can actually be locked is not public.

That split is the whole user problem in one place. The firm can make the account screen look whole. It has not yet said when anyone can take coins off the platform.

Nine Assets Left in Under Three Hours

On-chain tracker Lookonchain listed nine assets in the drain. XRP was the largest slice, then ether, then a bundle of dollar stablecoins. Tokenized gold, BNB, AVAX, and TRX filled out the rest. Those token counts are Lookonchain’s snapshot, priced at the moment it published, and sit beside Bitget’s own $351.6 million estimate rather than replacing it.

LOOKONCHAIN TOKEN COUNT

SlowMist tied the theft to 11 EVM addresses, seven XRP Ledger addresses, and one Tron address, and said the attacker has been turning EVM-chain coins into ether. Arkham timed the visible drain from 18:31 UTC to 21:23 UTC, just under three hours, across seven chains and five wallets. Inside that window, it said $228 million left between 18:58 and 19:16 UTC, an 18-minute burst.

The Stolen Coins Are Already Becoming Ether

The second-order loss starts after the first hop. Dollar coins and gold tokens can still be frozen by issuers. Ether cannot. Arkham said stablecoins and gold were being sold for ETH within 10 minutes of the drain, which is the standard first move when the goal is to get off assets a company can still stop.

THE FIRST HOPS OFF BITGET

• The swap: Stablecoins and Tether gold were sold for ether almost immediately after they left the exchange.
• The desk: About $25 million of USDT went through Rizzolver in five $5 million fills, with the rest routed through Uniswap, 1inch, and Furucombo.
• The bridges: Ether on Arbitrum, Optimism, and Base was moved onto Ethereum through Across, Stargate, and LayerZero, mostly in 400 to 500 ETH lots.
• The XRP trail: On-chain investigator Specter linked outbound XRP to funds from AFX’s roughly $24 million July theft, a job already tied to TraderTraitor, a North Korea cluster.

That last link does not prove who hit Bitget. It does show the stolen XRP already sitting on rails used in an earlier job attributed to the same cluster. Chen’s “highly consistent” line and that routing point at the same place, still without a courtroom-grade name on the wallet.

About 66% of First-Half Thefts Tied to North Korea

TRM Labs, in its first-half 2026 review, found North Korea-linked actors took about $643 million, about 66 percent of all funds stolen in hacks and exploits from January through June. That share is lower than the 76 percent TRM published through April, because smaller non-state jobs piled up while Pyongyang’s total barely moved. It is still the largest source of stolen value TRM recorded in the half.

H1 2026 HACK SNAPSHOT

• Total stolen: $972 million across 207 incidents, a record count for a half, and less than half the $2.3 billion taken in the first half of 2025.
• North Korea’s cut: about $643 million, or about 66 percent, down from roughly $1.7 billion in the first half of 2025.
• The two April jobs: Drift Protocol about $285 million and KelpDAO about $292 million, together about $577 million.
• The typical job: a median of about $219,000; infrastructure compromises were about 15 percent of incidents and about 76 percent of the dollars.

Bitget’s $351.6 million, if the North Korea suspicion holds, is another infrastructure job of the kind that already dominates the dollar totals. It is larger than KelpDAO and Drift, and larger than the Liquid Network drain earlier in September.

THE 2026 HAULS IN VIEW

Liquid was a bug-plus-white-hat story: about 4,000 bitcoin left, then 3,400 came back after a patch, with about $47 million kept. Bitget is the other kind of 2026 theft. No one has offered to send the stack home.

A U.S. Report Ties Stolen Crypto to Weapons Finance

That is why a covered customer ledger and a missing coin pile are not the same event. The Treasury Department’s 2026 National Proliferation Financing Risk Assessment, published in March, treats North Korean crypto theft as a weapons-finance problem, not only a market-crime problem. It says the DPRK uses laundering networks to convert stolen digital assets into revenue for the regime’s weapons programs, including mixers, weak exchange controls, and over-the-counter desks that turn coins into goods.

The DPRK uses sophisticated laundering networks to convert stolen digital assets into revenue for the regime’s weapons programs.

U.S. Department of the Treasury, 2026 National Proliferation Financing Risk Assessment

The same assessment cites the February 2025 theft of digital assets valued at $1.5 billion from Bybit as one of the largest digital-asset thefts on record. A later civil complaint filed for Bybit against the Democratic People’s Republic of Korea repeats that $1.5 billion figure and calls Lazarus Group the operator. CrowdStrike separately put North Korea-linked crypto theft at $2.02 billion for 2025, a 51 percent rise from the year before.

If Chen’s pattern match is right, Bitget’s $351.6 million does not sit in an insurance pool. It sits in the same revenue line Treasury already treats as a way to pay for missiles. The fund can make Bitget users whole on a screen. It does not intercept that line.

Bybit Opens Its Lazarus Bounty to Bitget

Bybit chief executive Ben Zhou spent Friday offering the help Bitget once gave his firm. He said his team was on standby, and that Bybit was updating its Lazarus bounty site to trace stolen funds from the Bitget drain. Chen replied that the two exchanges were “all in this together.”

Bybit team is standby to help in any ways that we can. Bitget helped us when we had the hack.
we are updating https://t.co/qbieK9k1lK to help Bitget to capture and trace the stolen fund movement. https://t.co/5hkfhUCaLt

— Ben Zhou (@benbybit) September 25, 2026

The bounty list is a tracing tool, not a refund. It exists because the February 2025 Bybit theft, at $1.5 billion, was large enough to force exchanges to share attacker addresses in public. Zhou’s post does not put a single stolen Bitget token back in a hot wallet. It does put this drain on the same hunt used after the last nine-figure North Korea job against a major exchange.

Withdrawals were still paused on September 25. Chen still would not name a restart time. The protection fund still sits, on paper, above $351.6 million. The coins that left at 18:31 UTC are already in ether, on bridges, and on a trail that runs toward a cluster with a weapons budget attached.

Disclaimer: This article is news reporting and analysis of a disclosed exchange theft and related public statements. It is informational only and does not constitute investment, trading, legal, or cybersecurity advice. Readers should consult a qualified financial adviser, attorney, or security professional before making decisions about crypto custody, withdrawals, or claims against an exchange. Figures, attribution, and withdrawal status reflect company notices, on-chain trackers, and official reports as of the dates named in this piece and may change as the investigation continues.