On 24 September 2026 Bitget said unauthorised transfers had left parts of its hot-wallet and warm-wallet infrastructure. One public post puts the detection at 18:31 UTC. The support notice puts reconciliation’s detection at 19:05 UTC. Use both as the company’s clocks, not as two incidents. The first loss figure was approximately $351.6 million. A follow-up revised that to about $387.5 million after Zcash and TRON assets from the same window were counted. Bitget said the revision was not a second wave of transfers. Cold wallets, it said, stayed outside the breach. Withdrawals were suspended. Deposits and trading were described as still up. Customer account balances were described as still accurate because the loss was the company’s inventory, not a rewrite of the user ledger.
That last sentence is the product. An exchange balance is an IOU, not a wallet. The coins in a hot wallet are the exchange’s coins, batched so withdrawals can clear. When they leave, the exchange still owes you the number on the screen, if it can pay. Bitget pointed at a User Protection Fund it said then held more than $464 million, and said this loss sat inside that coverage. A fund is a company promise with a balance sheet. It is not a protocol guarantee and not a government deposit scheme.
What happened
Bitget’s account of the path, filled in by a 30 September note on reports from Mandiant and SlowMist, is that third-party security products were compromised. That let an attacker into the wallet environment and push forged withdrawal commands through Bitget’s own approval process. The exchange said customer private keys were not stolen and that forged customer withdrawal requests were not the mechanism. Cold storage was the tier that did not move. Hot and warm were the tiers that did. A vendor box that is allowed to influence signing is part of custody, even if the marketing diagram draws it outside the “wallet”.
Assets named in the tracing updates include ether and other EVM balances, XRP, zcash, tether, USDC, BNB, AVAX, and TRX. Some funds were frozen with help from issuers, exchanges, and other projects. Bitget offered a bounty of 5 percent of amounts frozen or recovered. We will not publish attacker addresses or a reproduction of the vendor bug. The lesson does not need a map.
Do not mash this into Bybit’s 2025 theft, KuCoin’s 2020 hot wallet, or Binance’s 2019 hot wallet beyond the shared shape: an exchange’s spendable float moved. The stated cause here is a supplier’s security product, not a user clicking a phishing link and not a chain halt. Do not mash it into the Cosmos Hub restart the day before. That was validators editing one account. This is a company database and a company key ceremony. Reporting after 1 October, including Chainalysis, has pointed at North Korea. Treat that as an attribution in circulation, not as a fact this page can prove. Bitget’s first notice said it would not speculate on the vector while the investigation was open. The vendor finding came later. A state label can arrive later still.
Why it matters
If you had a Bitget login, your risk on 24 September was withdrawal delay and the credit of the company, not a drained seed phrase in your kitchen drawer. If you self-custody, this page is someone else’s hot wallet. If you keep coins on any exchange so that withdrawals are instant, you are holding a claim on whatever sits in hot and warm storage plus whatever insurance or protection fund the terms actually say. Read the terms. See how crypto wallets actually work if the difference between a login and a key is still mush. See a practical checklist for keeping crypto safer for the phishing that will wear Bitget’s logo and ask you to “verify” a phrase so the fund can reimburse you. Nobody legitimate needs that phrase.
What happens next
A withdrawal restart on Bitget’s clock, more freezes, a bounty that will not make users whole by itself, and arguments about how a third-party product was allowed near the approval path. Watch Bitget’s support notices. We will not turn an exchange theft into a buy or a sell, and we will not pretend the chains those tickers live on failed because a hot wallet did.
Not a review of Bitget. Not an instruction to withdraw, deposit, buy, or sell. Not a claim that any particular user was paid by the protection fund.
