Cryptocurrency exchange Bitget confirmed on Thursday that attackers stole approximately $351.6 million from parts of its hot and warm wallets.
Bitget’s security systems detected the unauthorized transfers at 18:31 UTC on September 24, 2026. The company activated emergency response protocols at once.
Bitget Chief Executive Officer Gracy Chen stated that the attackers compromised a critical backend system within the wallet infrastructure. They then spoofed transaction data and triggered the exchange’s authorization process to move funds out.
“Private key compromise has been ruled out,” Chen wrote on X.
The breach affected only portions of the hot and warm wallet layers. Cold wallets remained fully secure. The incident involved 19 attacker transfers across networks that included Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum.
Bitget said user account balances remained accurate. The full loss falls within the coverage of its User Protection Fund, which held more than $464 million at the time of the incident.
Deposits and trading continued to operate normally. However, the exchange temporarily suspended withdrawals as a precaution while it conducted a security review.
Bitget flagged the abnormal transfer addresses and reported them. It also notified law enforcement and on-chain security firms.
Chen later indicated that investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. She said the pattern of the attack resembled earlier operations attributed to that group.
Bitget stated that it would provide hourly updates on the incident across its official channels.
