Cryptocurrency exchange Bitget has reported a security breach affecting approximately $351.6 million in digital assets, after attackers moved funds from parts of its hot and warm wallet infrastructure.
The incident was first reported after blockchain observers identified more than $170 million in assets moving from Bitget-linked wallets to an unidentified address. The assets reportedly included XRP, Ether, USDT, USDC, Avalanche, and BNB. Subsequent reports placed the total impact of the incident at approximately $351.6 million.
Bitget detected the unauthorised transfers on September 24, 2026, and activated its emergency response procedures. The exchange suspended withdrawals while it investigated the incident, although trading and deposits reportedly remained available.
Attack reportedly targeted backend wallet infrastructure
Bitget CEO Gracy Chen said the attackers did not obtain the private keys associated with the exchange’s hot, warm, or cold wallets.
Instead, Chen said the attackers compromised a critical backend system within Bitget’s wallet infrastructure, spoofed transaction data, and used the altered information to trigger the authorisation process that moved the assets.
This account suggests that the incident involved the systems responsible for processing and approving transactions rather than a direct theft of private keys. Bitget has said its cold wallets were not affected.
The exchange has not yet released a complete technical report detailing how the backend system was compromised. A full report is expected to provide additional information about the intrusion, the affected systems, and the movement of funds.
More than $170 million initially identified on-chain
The first reports focused on more than $170 million in crypto assets that had moved from Bitget-linked wallets to a single unidentified address.
On-chain tracking indicated that the assets were subsequently swapped, with Ether accounting for a significant part of the reported activity. The initial figure represented the funds visible through blockchain transactions and did not necessarily reflect the total value affected by the breach.
Bitget later reported a wider estimated impact of $351.6 million. The two figures therefore describe different stages of the incident: the initial on-chain alert and the exchange’s subsequent internal assessment.
A complete wallet-by-wallet reconciliation has not yet been publicly detailed in the available reports.
Withdrawals suspended as investigation continues
Following the incident, Bitget suspended withdrawals as part of its security response. Reports indicated that deposits and regular trading remained available while the exchange reviewed the affected systems and transactions.
Chen said Bitget’s customer balances remained accurate and that the company’s User Protection Fund would cover the losses. Reports placed the fund’s value at more than $464 million. Bitget has also said it holds more than $1 billion in proprietary capital, although the company’s coverage commitments and financial position should be assessed against its formal statements and subsequent disclosures.
The timing for the resumption of withdrawals was not confirmed in the reports reviewed.
North Korea connection under investigation
Bitget’s CEO said the company believed North Korean hackers were very likely behind the attack.
Chen reportedly referred to IP addresses that matched VPN choices associated with a North Korean group. However, the specific group responsible had not been publicly identified, and the attribution remained under investigation.
Blockchain analyst Specter linked the movement of stolen XRP to funds associated with an earlier AFX exploit. The analyst suggested a possible connection to TraderTraitor, a group linked to North Korea by previous security investigations.
These links remain attributed claims rather than a final finding. A confirmed attribution would require additional forensic evidence and investigation by the relevant security teams and authorities.
What the incident means for crypto exchange security
The reported breach highlights the security risks associated with backend systems that manage digital asset transactions.
Crypto exchanges commonly use different wallet layers, including hot wallets for online operations, warm wallets for intermediate storage and processing, and cold wallets for offline asset storage. While cold storage can reduce exposure to certain online attacks, other systems connected to transaction authorisation can also become targets.
Bitget’s account of the incident suggests that attackers may be able to manipulate transaction-processing systems without directly obtaining private keys. The final technical report will be important for determining how the intrusion occurred and what controls could prevent a similar incident.
Bitget has said it is investigating the breach and working with security teams and law enforcement agencies. Further information is expected as the investigation progresses.
Read also: VASPA and VAAK Sign MoU to Strengthen Africa’s Virtual Asset Ecosystem