Image: “Password hacking illustration” by Santeri Viinamäki, licensed CC BY-SA 4.0, source: Wikimedia Commons
No stolen private key – yet $351.6 million gone. Crypto exchange Bitget became the victim of the largest confirmed exchange hack of the year on September 24, 2026. The attackers didn’t come through the front door; they came through a forged internal approval: they compromised a backend system in the wallet infrastructure, fed it spoofed transaction data, and let Bitget’s own authorization process sign off on the transfers.
The incident highlights a new class of attack that undermines classic security assumptions: when it’s not the key itself but the signing process that gets compromised, cold wallets alone no longer provide full protection.
The Timeline: How the Hack Was Discovered
At 18:31 UTC on September 24, 2026, Bitget’s security systems flagged unauthorized transfers from portions of its hot and warm wallet infrastructure. CEO Gracy Chen confirmed the breach on X shortly after. A total of 19 individual transfers moved funds out of the system, affecting the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum networks.
Bitget uses a three-tier wallet architecture: hot wallets for instant withdrawals, warm wallets as a buffer, and cold wallets kept fully offline. According to Chen, the cold wallets – and therefore the bulk of customer funds – remained untouched.
The Attack Method: Forged Data, Not Stolen Keys
What makes this hack notable is the method itself. Chen described it using an analogy: it was as if criminals had slipped forged withdrawal slips through a bank’s legitimate teller window – while the vault itself stayed locked.
"The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. Private key compromise has been ruled out." – Gracy Chen, CEO Bitget
In concrete terms: the attackers did not obtain a private key, nor did they forge user withdrawal requests. Instead, they infiltrated the system that prepares transactions, injected manipulated transfer data, and let the exchange’s genuine, regular signing process approve the forged instructions. The signature was real – the signed data was not.
Where the Money Went
On-chain analysts at Lookonchain and Arkham Intelligence tracked the movements in real time. XRP accounted for the largest share of the haul, with roughly 102.9 million tokens (about $158 million), followed by around 31,890 ETH worth approximately $86 million. Other affected assets included USDT, USDC, USDT0, AVAX, BNB, and tokenized gold (XAUT).
Particularly notable: a freshly created address swapped $19.67 million worth of USDT0 for 7,111 ETH in roughly six minutes – via UniswapX and 1inch Fusion, paying a premium of up to 5 percent above market price. That premium is itself a signature: someone willing to overpay by 5 percent is prioritizing speed over price, because stablecoins can be frozen by their issuer while ETH cannot. The swap wasn’t a trading strategy – it was conversion into an asset nobody can claw back.
Suspect: North Korea’s Lazarus Group
In a public livestream on X, Chen said investigators had identified IP addresses matching VPN services previously used by a North Korean hacking group, and that the attack pattern resembled earlier operations attributed to the country. Bitget says it has ruled out an inside job.
North Korean groups were linked to an estimated $2.02 billion in crypto theft in 2025 according to TRM Labs – including the largest single case to date, the $1.5 billion Bybit hack in February 2025, which the FBI also attributed to North Korea. Bybit CEO Ben Zhou publicly offered Bitget support following the current incident; Bitget had reciprocated by helping Bybit after its 2025 hack.
Bitget’s Response: User Protection Fund and Withdrawal Freeze
Bitget says customer balance accounting remains unchanged and points to its User Protection Fund, which holds more than $464 million in reserves and is meant to cover the full loss. Deposits and trading continue normally, but withdrawals remain suspended pending completion of a security review.
Chen deliberately avoided committing to a firm timeline for reopening withdrawals, saying the exchange would not promise a window it couldn’t guarantee. A full technical report on the exact attack method has been promised but had not been published at the time of this article.
Context: The Most Expensive Month of the Year
At $351.6 million, the Bitget hack surpasses the previous high-water mark for the year, a $320 million incident at Liquid Network in early September 2026. Analyses put total crypto hack losses for 2026 at more than $2 billion across 281 incidents – Bitget alone accounts for roughly 16 percent of that total. September 2026 is now the most expensive month of the year, ahead of the previous record set in April at roughly $648 million in damages.
What Users Should Know Right Now
Bitget users can continue to deposit and trade; withdrawals are temporarily frozen. Bitget maintains that account balances are accurate and covered by the Protection Fund. Important during this window: incidents like this historically trigger a spike in phishing attempts posing as official "account recovery" assistance. Legitimate communication comes exclusively through Bitget’s verified channels.
For the industry as a whole, the incident makes one thing clear: security architecture must protect not just keys, but the integrity of the systems that decide what gets signed in the first place.
