Bitget raised losses from its September 24 hot-wallet breach to $387.5 million and said withdrawals would resume in phases starting September 28, a sequence that protects customers on paper while leaving the authorization model that failed still in public view.
Attackers compromised backend wallet infrastructure, spoofed transaction data, and triggered Bitget's internal authorization flow to empty hot and warm wallets. Private keys were not taken; cold storage and the separate Bitget Wallet product were untouched. Stolen assets included roughly 103 million XRP — about $157 million at the time — plus ETH, USDT, USDC, BNB, AVAX, ZEC, and TRX. Initial estimates near $352 million were revised after additional Zcash and Tron traces. Chief executive Gracy Chen and analytics firm Elliptic have called a North Korean link highly likely, citing patterns that also appeared in the 2025 Bybit theft. Suspected North Korean crypto thefts for 2026 have now passed $1 billion.
Bitget says the loss is covered by a User Protection Fund that held more than $464 million in bitcoin, and it hired Mandiant and SlowMist. Trading and deposits continued while withdrawals were frozen. THORChain declined to block related wallets. Some funds were reportedly mixed through Wasabi CoinJoin. Coverage is the customer story. The operational story is that an internal authorization process signed off on spoofed data without a second, out-of-band check.
The second-order lesson is not that exchanges need bigger insurance pools. It is that hot-wallet signing is still a single workflow, and a workflow can be lied to. Last week's Drift exploit produced recovery tokens. Bitget produced a fund draw and a phased restart. Neither redesigns the signing path. Until that path requires a human-visible, independently authenticated instruction, the next drain will also be "covered" — after the money has moved.
Image source: i.ibb.co