Bitget Hack Revised to US$387.5 Million, Withdrawals Restarting
The number moved twice and the cause is now named: a vulnerability in a third-party security product, not a private key leak. Withdrawals are reopening, starting with bitcoin.
Quick answer: Bitget now puts the 24 September 2026 theft at about US$387.5 million, up from its first estimate of US$351.6 million, after adding assets on Zcash and TRON that the first count missed. The company says attackers exploited a vulnerability in a third-party security product, that private keys and cold wallets were never compromised, and that withdrawals are restarting with bitcoin first.
Key takeaways
- The number moved: from US$351.6 million to about US$387.5 million, after on-chain tracing added transfers on Zcash and TRON.
- The cause, per Bitget: a vulnerability in a third-party security product that gave attackers credentials. No private key leak and no cold wallet compromise.
- They rehearsed it. The attacker sent small transfers first to test the risk controls before the large ones, according to the CEO.
- Withdrawals are reopening: 9,585 bitcoin withdrawals totalling 4,098 BTC were processed by 09:00 UTC on 28 September, with ETH following and a security report promised this week.
Bitget, one of the largest crypto exchanges, lost about US$351.6 million to an attacker on 24 September 2026. Here is what is known so far, from the company and from on-chain trackers.
What happened, and what changed since
At 18:31 UTC on 24 September 2026, Bitget detected unauthorised transfers leaving hot and warm wallets and paused withdrawals. The first public figure was about US$351.6 million.
| First statement | Latest | |
|---|---|---|
| Amount | US$351.6 million | about US$387.5 million |
| Why it changed | hot and warm wallet transfers counted | Zcash and TRON transfers added by on-chain tracing |
| Cause | unknown, private key leak ruled out | vulnerability in a third-party security product |
| Withdrawals | paused | restarting, bitcoin first, ETH from 29 September |
| Investigators | internal team | Mandiant and SlowMist alongside the internal team |
Bitget says the vulnerability has been identified and fixed, the incident is contained with no further unauthorised transfers possible, and the US$464 million User Protection Fund remains available. A fund tracing and recovery bounty programme is running.
What the CEO said on the livestream
On 25 September, Gracy Chen held a livestream of more than three hours and posted a summary afterwards. The detail that stands out a week later is that the attacker rehearsed: small transfers went through first to test the risk controls before the large ones moved.
刚才上午跟大家做了个三个多小时的直播，这里总结一下直播中聊到的点：
— Gracy Chen @Bitget (@GracyBitget) September 25, 2026
① Bitget 安全事件12小时进展通报。以下为具体信息，不打官腔。
②… https://t.co/kkVr4Ybd9S
- No private key leak. The attacker breached one of the core backend systems of the wallet service, generated false transfer data and triggered the approval and signing process from inside.
- Assets hit: ETH, XRP, BNB, AVAX, USDT, USDC and others, across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. All on-chain cold wallets were confirmed secure.
- Some hacker addresses frozen. Bitget contacted the affected chain foundations and several confirmed freezes.
- Attribution: IP behaviour and on-chain analysis are consistent with known North Korean patterns, per the company. It has reported the incident to authorities.
- Bitget Wallet was not affected. It runs on separate infrastructure from the exchange.
- Balance sheet: a protection fund of more than US$464 million plus company assets stated at more than US$1 billion, with user funds backed 1:1.
The company had announced the livestream a few hours earlier, while the incident was still unfolding.
Our CEO, @GracyBitget will host a live update in few minutes to address the incident directly.
— Bitget (@bitget) September 24, 2026
Transparency remains our priority. We’ll share more information soon. https://t.co/BmKK67kK8n
The first detailed account came from co-founder Xie Jiayin, who posted the timeline and the US$351.6 million figure in Chinese.
今天凌晨2:31 Bitget安全系统监测到部分热钱包出现异常转账。安全团队在第一时间启动应急响应机制。
— 谢家印 (@xiejiayinBitget) September 24, 2026
一、已确认的情况：
1、初步评估涉及金额约3.516亿美金
2、冷钱包及平台绝大部分资产完整，未受影响…
What Bitget says about customer money
- Customer balances are correct on the platform.
- The loss is covered by the User Protection Fund, which holds more than US$464 million.
- Deposits and trading are still running.
- Withdrawals are paused while a security review runs. No end time has been given.
- Addresses linked to the attacker have been flagged, and a full report is promised.
In Chen's words: the full amount of the loss falls within the coverage of the protection fund.
How it compares with the rest of 2026
This is the largest crypto exchange hack of 2026, and it pushes September past April as the costliest month of the year for crypto theft.
| Measure | 2026 so far |
|---|---|
| Hacks counted in the first half | 207 |
| Total stolen, TRM Labs estimate | about US$972 million |
| Total stolen, CertiK estimate | about US$1.32 billion |
| Share attributed to North Korea | about 66 percent, or US$643 million |
| This single incident | US$351.6 million |
Most large losses this year came from stolen keys and social engineering rather than clever smart contract bugs. The Bitget attack method has not been published, so it is not yet clear which category it falls into.
What to do if you have funds on an exchange
- Do not panic-move funds through unfamiliar links. Phishing always spikes in the days after a hack.
- Follow the exchange's own announcement channels, not messages sent to you.
- Once withdrawals reopen, move out anything you are not actively trading.
- Check whether the exchanges you use publish a protection fund at all. Most do not.
Why this matters even though the money is covered
Nobody is short a dollar if the fund pays. But a correct balance you cannot withdraw is not the same as money in your hand. Rent does not pause. A market that moves while withdrawals are frozen moves without you.
That is the difference between custody and self-custody. On an exchange, someone else holds the button that stops your withdrawal. Fizen is non-custodial, so there is no such button here, and the trade is blunt: if you lose your recovery phrase, nobody, Fizen included, can restore it.
Frequently asked questions
How much did Bitget lose?
About US$387.5 million, revised up from the first estimate of US$351.6 million once transfers on Zcash and TRON were traced.
How did the Bitget hack happen?
Bitget says attackers exploited a vulnerability in a third-party security product to obtain credentials. Private keys and cold wallets were not compromised.
Can I withdraw from Bitget now?
Withdrawals restarted with bitcoin on 28 September, 9,585 withdrawals totalling 4,098 BTC by 09:00 UTC, with ETH from 29 September. Check the exchange's own announcements for the current state.
Is customer money safe?
Bitget says balances are correct and the loss is covered by its User Protection Fund, which holds more than US$464 million.
Can I withdraw from Bitget right now?
Withdrawals were paused after the hack. Deposits and trading continued. Check the exchange's own announcements for the current status.
Which wallets were hit?
Some hot and warm wallets. Cold wallets and most assets on the platform were reported unaffected.
No pause button on your own balance
Fizen is a non-custodial USDT app: the balance sits in a wallet you control, with an investment from Tether in the company. The trade is real, because nobody, Fizen included, can restore a lost recovery phrase. Availability depends on your country and partners. Not offered to US Persons.
Terms and conditions
- Information only. This article reports a publicly documented security incident and general security practice. It is not an offer or sale of any product or service, and it is not financial, legal or tax advice.
- For readers in the United States. This article provides information only. It is not an offer, solicitation or sale of any product or service, and it is not financial, investment, legal or tax advice. Fizen is not offered to US Persons.
- Independent. Fizen is not affiliated with, endorsed by or a partner of Bitget, Bubblemaps, TRM Labs or CertiK. Figures here are what the company and public reports stated on 24 and 25 September 2026, and may be revised as the investigation continues.
- Full terms. See the Master Terms of Use, Privacy Policy and Disclaimer on the Fizen website.
Sources
- Bitget Support: incident update, fund tracing and recovery bounty
- Bitcoin.com News: Bitget restarts bitcoin withdrawals as the US$388M investigation widens
- The Block: attacker tested risk controls with small transfers before the theft
- Gracy Chen on X: summary of the three hour livestream
- Forbes: the first confirmed figure of US$351.6 million
- CryptoSlate: timings and the User Protection Fund
Updated 29 September 2026 with the revised figure and the withdrawal restart.
