Bitget's $387.5 Million Theft: Multi-Chain Hot Wallet Losses Across XRP, EVM, Zcash, and Tron
Attackers stole approximately $387.5 million in crypto assets from Bitget, prompting a temporary withdrawal suspension. Bitget initially estimated the loss at $351.6 million, later increasing the total after identifying additional transfers on Zcash and Tron. The company said cold wallets and the separately operated Bitget Wallet were unaffected, and that its protection fund and company reserves were sufficient to cover the loss. CEO Gracy Chen said the attack resembled known North Korean hacking activity, while Bitget engaged Mandiant and SlowMist and launched a bounty program to support freezing and recovery efforts. The precise technical entry point was not disclosed.
This article is published for educational and informational purposes only. It does not constitute legal, financial, or investment advice. Nothing in this article should be relied upon as the sole basis for any decision relating to the security, investment value, or legal standing of any protocol or digital asset.
This is a preliminary analysis based on publicly available reporting and open-source code review. An official post-mortem has not yet been published by the affected protocol at time of writing. Any code samples included are illustrative reconstructions for educational purposes only and do not represent confirmed exploit code. This article will be updated when authoritative technical disclosure is available.
Information published on any code vulnerabilities must not be used to attack, test, or probe any protocol or system without explicit authorisation from its owner. Use of this content is subject to our Terms of Service and Privacy Policy.
What happened
On September 24, 2026, attackers transferred approximately $387.5 million in crypto assets from Bitget to addresses under their control. Bitget CEO Gracy Chen confirmed the incident, initially putting the loss at $351.6 million. She said cold wallets were unaffected and that withdrawals had been temporarily disabled.
In its September 25 update, Bitget revised the total to approximately $387.5 million after identifying additional affected assets on Zcash and Tron. The exchange said the revision reflected more complete accounting, not further theft.
The affected assets spanned Ethereum and other EVM networks, the XRP Ledger, Zcash, and Tron. The confirmed asset list included XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX. In a follow-up statement, Chen identified XRP as the largest single-chain loss and said the separately operated Bitget Wallet product was unaffected.
Bitget said the incident was contained and that no further unauthorized transfers were possible. Mandiant and SlowMist were assisting with the investigation. According to the update, the underlying vulnerability had been identified and remediated, and the restoration of withdrawals was awaiting further security checks.
On coverage, Chen said Bitget's protection fund exceeded $464 million and could cover the loss, and that the exchange held more than $1 billion in company-owned assets on top of that fund while maintaining 1:1 coverage of customer assets. Bitget also launched a recovery program offering eligible contributors 5% of funds successfully frozen and 5% of funds successfully recovered, subject to its terms.
Chen said IP behavior patterns and on-chain analysis were highly consistent with known North Korean hacking activity.
Root cause
Bitget has not disclosed the precise technical vulnerability. Its update says only that the issue was identified and remediated. What the public record does establish is the shape of the incident: funds moved out of exchange-controlled infrastructure across several unrelated blockchains, while cold storage was, according to Bitget, untouched.
What the pattern suggests
XRP Ledger, Zcash, Tron, and the EVM networks share no common smart contract layer. A single contract bug cannot explain losses across all of them. When an exchange loses funds on many unrelated chains at once while its cold wallets remain intact, the most likely explanation is a compromise of the systems that operate its hot wallets: the infrastructure that holds online keys or decides which withdrawals to sign. This is an inference from the pattern, not a finding Bitget has published.
The pattern is also consistent with other recent exchange thefts attributed to North Korean operators, which typically target signing infrastructure rather than blockchain-level flaws. Bitget's own attribution points in the same direction, but the sources available do not independently establish it.
initial_estimate = $351.6M // CEO statement, Sept 24
revised_total = $387.5M // Bitget update, Sept 25
revision_reason = additional affected assets on Zcash and Tron
// more complete accounting, not further theft
networks = Ethereum + EVM networks, XRP Ledger, Zcash, Tron
assets = XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, TRX
largest_single_chain = XRP
unaffected (per Bitget) = cold wallets, Bitget Wallet
protection_fund = > $464M
company_owned_assets = > $1B (in addition to the fund)
recovery_program = 5% of funds frozen, 5% of funds recovered
frozen_amount = not quantified by BitgetWhy the total moved
The jump from $351.6 million to $387.5 million is worth noting. Initial estimates in multi-chain incidents are often built from the most visible chains first. Assets on networks like Zcash, where shielded transactions are harder to trace, can take longer to account for. Bitget's statement that the increase reflected fuller accounting rather than continued theft is consistent with its claim that the incident was contained.
What could have been done
- Minimize hot wallet balances on every chain. Losses spread across many networks show that each hot wallet carried meaningful value. Keeping only what daily withdrawals require, and refilling from cold storage through a slower, multi-party process, caps how much any compromise can reach.
- Enforce withdrawal policy inside the signer. Signing systems should independently check destinations, amounts, and velocity, not just trust the internal service that submits requests. A request to move large sums to new addresses across several chains in a short window should be refused or escalated at the point of signing.
- Alert on cross-chain anomalies, not just per-chain thresholds. Simultaneous unusual outflows on unrelated networks are a strong signal of infrastructure compromise. Monitoring that correlates activity across chains can trigger an automatic pause faster than per-chain rules that each look normal on their own.
- Track every chain in real time from the first minute. The revision from $351.6 million to $387.5 million came from assets on Zcash and Tron being identified later. Complete, real-time accounting across all supported networks speeds up both the freeze requests sent to issuers and the information given to customers.
- Pre-arrange freeze channels with issuers. USDT, USDC, USDT0, and XAUt were among the stolen assets, and all have issuers who can freeze tokens. Standing relationships and direct escalation paths make it more likely those freezes land before the attacker can swap into assets that cannot be frozen.
- Publish a technical post-mortem. Bitget has said the vulnerability was found and fixed but not what it was. A detailed disclosure, once safe to share, would let other exchanges check whether they carry the same weakness, and would allow independent review of the claims about cold wallets and containment.
Lessons for the industry
The Bitget theft is one of several large centralized exchange losses in 2026, and the pattern is becoming familiar: funds leave hot wallets across many chains at once, cold storage is reported safe, and the company points to North Korean tradecraft. Five weeks later, Binance suffered a far larger theft with a similar multi-chain profile. The common thread is that attackers are targeting the operational systems around keys, not the cryptography or the blockchains.
Bitget's response included a fast acknowledgement, a withdrawal suspension, outside investigators, a recovery bounty, and public assurances about reserves. That is a reasonable playbook. But much of what customers were asked to rely on (that cold wallets were untouched, that the fund and reserves cover the loss, that 1:1 backing is intact) remains self-reported. Independent verification, through proof of reserves or a third-party audit, would turn those assurances into evidence.
Finally, the revised total is a reminder that early loss figures are provisional. In multi-chain incidents, assets on less-monitored networks can surface hours or days later. Reporting should treat the first number as a floor, and exchanges should say clearly, as Bitget did, whether a revision reflects new theft or better accounting.
- 01Bitget, Security incident update, fund tracing and recovery bounty program
- 02Gracy Chen on X, Initial confirmation and withdrawal suspension
- 03Gracy Chen on X, Follow-up on affected assets, suspected attribution and reserves
- 04Wayback Machine, Archived September 26 copy of Bitget's incident update