Bitget $387.5M Hack Explained: What Happened, Repayment & Security Upgrades

Bitget loses $387.5M in a hot-wallet hack — the biggest crypto theft of 2026

On September 24, 2026, crypto exchange Bitget disclosed that attackers drained roughly $387.5 million from its hot and warm wallets, making it the largest crypto theft of the year so far. The twist: no private keys were stolen. Attackers exploited a flaw in a third-party security product to forge internal transfer requests, and the system approved the withdrawal. Bitget says customer balances were untouched.

How the attack unfolded

The entry point was an outsourced security tool. Bitget says attackers used a zero-day in that product to fake internal transfer instructions; the platform treated them as legitimate and released the funds. The approval process was defeated, not key custody — the private keys were never compromised.

Bitget halted all withdrawals for a stretch. Around September 27-28, Bitcoin withdrawals came back first, with other assets restored in phases. The attackers moved about $83 million in XRP, while stablecoin issuers Circle and Tether froze only about $318,000 combined. Bitget publicly asked the cross-chain protocol THORChain to refuse the stolen assets, and Binance founder CZ offered to help. The exchange later posted a 5% recovery bounty.

Background and context

The case puts third-party supply-chain risk front and center. Exchanges buy much of their security stack from outside vendors, so one zero-day can open a path into the money flow even when a platform's own key management is sound. The precedent is close: in February 2025, Bybit lost about $1.46 billion — still the largest crypto theft on record. In barely 18 months, two cases near the billion-dollar mark have exposed how thin those process and supply-chain layers can be.

Like Bybit, Bitget pointed at North Korea, with CEO Gracy Chen calling the actor "most likely North Korea."

What it means for the market

For users, the reassurance is Bitget's claim that balances were unaffected and that its protection fund, then worth about $464 million, covered the roughly $387.5 million loss in full. The protection fund is an exchange's own payout pool for extreme security events; whether it can absorb the hit is a key signal of whether customer money is safe.

For the industry, the takeaway is blunt: even with safe keys and healthy reserves, supply chains and internal workflows can be breached. The attackers didn't pick the vault lock — they fooled the badge reader. For everyday investors, the lesson is diversification. Don't park everything on one platform. When comparing venues, major exchanges such as Binance and Bitget publish their own proof-of-reserves and protection mechanisms.

If you're opening an account or rebalancing, start from the official entry points of the main exchanges: Binance, OKX, or Gate.io. Splitting long-term holdings from day-to-day trading balances is what keeps a single incident from becoming a total loss.

Risk warning

A security incident can affect whether users can withdraw in time and can hit the price of the affected tokens in the short term. Judging an exchange on one event is a mistake; weigh its reserves, payout mechanism, and track record together.

Risk disclosure and affiliate notice: Crypto trading and holding carry the risk of losing your principal, and a security incident at an exchange can leave assets stuck. Nothing here is investment advice. This article contains affiliate links; signing up through them may earn us a commission at no extra cost to you, and it does not affect our independent judgment. Details, figures, and withdrawal recovery timelines are subject to Bitget's official announcements and are current as of October 2026.