Bitget Lost $351.6 Million Without Losing a Key. The Target Was the System That Decides What to Sign

What Happened

At 18:31 UTC on Thursday, September 24, Bitget's security systems flagged unauthorized transfers from what the exchange called a limited number of hot wallets. Analysts at Arkham Intelligence, PeckShield, and Hacken tracked roughly $183 million consolidating into a single address within the hour.

Bitget's first notice put the figure at about $351.6 million, nearly double those counts, and said the loss was contained to a portion of the hot and warm layers of a 3-tier wallet architecture, with cold wallets untouched. Withdrawals were suspended pending a security review; deposits and trading stayed open.

Chief executive Gracy Chen said the loss 'falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million,' promised hourly updates, and committed to a root-cause report within 24 hours. As of this writing the report has not appeared and no reopening time has been given.

Forbes noted funds still leaving the wallets at 21:23 UTC, almost 3 hours after detection.

The preliminary cause is what separates this from a routine hot-wallet drain. 'The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,' Chen wrote on X, adding that no private key was taken and no user withdrawal request was forged.

Lookonchain's count is led by 102.93 million XRP, about $157.5 million, and 31,890 ETH, about $85.8 million, with roughly $75 million in USDT, USDC, and USDT0 behind them. Chen called North Korean involvement 'very likely,' citing IP behavior that matched a known Democratic People's Republic of Korea (DPRK) group's VPN choices, while saying the attackers' identity is not confirmed.

By the reported figure it is the largest single theft of 2026 so far and, per TFTC, the costliest to hit a centralized exchange since Bybit's $1.5 billion in February 2025.

A signature proves a key agreed, not that it knew what it agreed to. Bitget's keys were never the target, and the same is true of yours.

The Keys Held. The Thing That Tells the Keys What to Sign Did Not

An exchange hot wallet is a pipeline, not a key on a server: a queue of withdrawal requests, a backend service that assembles them into transactions, an authorization layer that checks limits and approves them, and a signing module, often a hardware security module (HSM), that holds the key and signs whatever the pipeline hands it.

On Bitget's description the attacker entered upstream of the signature: a compromised backend service produced transaction data the authorization layer accepted as genuine, so the signer did its job. A signature proves that a key agreed. It does not prove the key knew what it was agreeing to; that gap is the entire attack.

That is why 'no private key was compromised' is true and beside the point: a key that signs on the instruction of a liar is the liar's key for as long as the lie holds.

The parallel is Bybit. In February 2025, Lazarus Group compromised a Safe{Wallet} developer's machine and injected code into the signing interface, so Bybit's multi-sig signers approved what looked like a routine transfer and was in fact a contract change that handed the wallet to the attacker.

Every signature was valid. Bitget's version swaps the human signers for an automated authorization process and the lying interface for a lying backend service; the shape is the same. There are 2 differences that matter. Bybit lost from cold storage; Bitget says its cold tier was never reached, consistent with an attack on the hot-wallet pipeline rather than the key ceremony.

Bybit's forensics named the vendor within days; Bitget has published a sentence. Until the report names the component and how it was reached (a vendor dependency, a stolen credential, a poisoned build), 'spoofed transaction data' describes the effect, not the cause.

40 Minutes to Outrun the Freeze, and a Guarantee Priced in the Wrong Coin

The laundering was aimed at issuer control. Tether and Circle can blacklist an address and immobilize USDT and USDC; ether has no issuer to call. Per Wu Blockchain's timeline, the stablecoins and gold tokens went to a second address and were swapped into about 22,600 ETH over roughly 40 minutes, and 1 freshly created wallet converted 19.

67 million USDT0 into 7,111 ETH in about 6 minutes on Arbitrum, paying up to 5% over market. A 5% premium on $19.67 million is close to $1 million spent to beat a freeze: issuer control priced from the thief's side of the table, real enough to pay for and slow enough to outrun. The XRP, the largest line, sits on a ledger with no freeze lever at all.

On-chain analyst Specter reported that a wallet receiving the stolen XRP had earlier sent ether to the address tagged as the AFX exploiter, the $24 million July bridge theft AFX itself attributed to the DPRK unit TraderTraitor; that is 1 analyst's tracing, not a law-enforcement finding.

Then there is the fund. Bitget's Protection Fund dates to 2022 and, per the exchange's monthly valuation reports, holds 5,500 BTC. The August report put it between $345.3 million and $441.5 million; Thursday's 'over $464 million' is the same bitcoin at a higher price, and the loss is about 76% of it.

2 things follow. The fund is a bitcoin position pledged against losses that were mostly XRP, ether, and dollar tokens, so making customers whole means selling bitcoin at whatever price prevails on the day. And a guarantee whose dollar value moves with bitcoin covers a fixed-dollar hole differently on different days; at the August low it would have fallen about $6 million short of Thursday's loss.

None of that says Bitget cannot pay. It says the guarantee is an exchange rate, and its size tomorrow depends on a price nobody at Bitget sets.

What This Means for You

Start with the case for Bitget, which is real. Bitget says its systems flagged the transfers and its emergency protocols started within minutes, and a reserve funded 4 years ago is pledged to absorb the loss. If it pays as promised, no customer loses a coin; there is no protection fund behind your hardware wallet if you sign a spoofed transaction.

Take that seriously, then price it. The guarantee arrives with withdrawals closed at the exchange's discretion, a payout that depends on bitcoin's price on the day it is made, and an exchange balance that is a claim on a pipeline you cannot inspect. If you hold a balance on Bitget: do not deposit more while withdrawals are paused, export your statements now in case a claims process wants them, and treat every message about 'compensation' or 'verification' in the coming weeks as phishing until you have typed the address yourself; the September 9 Trezor campaign is the template.

Bitget Wallet, the group's separate self-custody app, says it was unaffected, a distinction phishing will try to blur.

The mechanism transfers directly to self-custody, because a hardware wallet is the same architecture in miniature. Your laptop or phone is the backend service that assembles the transaction; the device is the signer. The only place the proposal meets the key is the device screen, and a device that signs whatever a compromised host proposes has Bitget's problem with a 1-person authorization layer.

Verify the destination address and amount on the device every time, and refuse a wallet that cannot show them. On Bitcoin, use software that passes a partially signed Bitcoin transaction (PSBT) to the device, and register your multi-sig descriptor on each signer so it can confirm which output is change; a co-signer that cannot check the change output can be walked into paying it to the attacker.

On Ethereum Virtual Machine (EVM) chains, turn off blind signing and use clear-signing modes where a wallet offers them. Multi-sig helps only if the signers sit on separate machines checking separate screens. 3 devices fed by 1 compromised host are 1 signer.

Name the limit. Self-custody moves the authorization pipeline onto your desk; it does not remove it. A hardware wallet can tell you which address it is about to sign for, not whether that address is the one you meant, and a compromised host can shape what you mean before you ever reach the device: the clipboard swap, the fake alert from a real vendor domain, the seed that was weak on the day it was made.

None of those attacks touch a key either. Key control is the necessary condition, and the honest work is everything upstream of the signature. At Bitget that work belonged to a backend team, and it failed. In your setup it belongs to you.

What to Watch

The 24-hour report is the first checkpoint: whether Bitget names the compromised component and the entry path, and whether it was a third-party dependency, which would make this the second major exchange in 19 months lost through a vendor rather than a key. Whether withdrawals reopen within days, and whether the Protection Fund is visibly drawn down, will show what the guarantee is worth in practice.

On attribution, an FBI or Chainalysis statement would carry more weight than IP patterns, and the Specter link to the AFX exploiter is the thread to pull. The industry question is whether exchanges start auditing the honesty of their transaction-assembly layer, not only the strength of their keys.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.