Bitget loses about $388 million from hot wallets, and its CEO cites third-party security software
September 24, 2026
Bitget detected unauthorized transfers on September 24 and suspended withdrawals. The first estimate was $351.6 million, later revised to about $387.5 million to $388 million, taken from hot and warm wallets. Bitget says cold storage was not affected, that its protection fund covers all customer losses, and that the attacker used a vulnerability in third-party security software to obtain internal credentials and insert fraudulent withdrawal instructions. No CVE or vendor has been named, so that claim is unverified. Bitget engaged Mandiant and SlowMist, resumed bitcoin withdrawals around September 27 and 28, and said North Korea is very likely responsible. Chainalysis later traced stolen XRP into bitcoin. No law-enforcement agency has confirmed attribution.
Why it matters
The attackers did not need to steal private keys. They went through a security product the exchange itself relied on, and one forensic report puts the earliest suspicious activity about 25 days before the theft.
What defenders can take from it
- Treat the security tools you run as part of your attack surface and keep their management interfaces off the internet.
- Add independent approval for withdrawals so that one set of stolen credentials is not enough.