Bitget suffered a $351 million theft from its hot and warm wallets on September 24, becoming the largest known crypto heist of 2026. Attackers bypassed private-key theft entirely by forging internal transfer approvals that passed the exchange’s existing workflow checks.
The incident began at 18:31 UTC when security systems flagged unauthorized transfers. By the following morning, roughly $351 million had left the platform across at least five blockchains. The single largest asset taken was approximately 103 million XRP, valued at about $157 million at the time.
After the funds were moved, the attackers quickly swapped them on decentralized exchanges. One newly created wallet spent nearly $20 million within six minutes while paying a 5 % premium, a classic money-laundering pattern executed under time pressure.
Bitget CEO Gracy Chen stated that the exchange holds a $464 million user-protection fund large enough to cover the entire loss. Customer balances remain accurate, deposits and trading continue normally, and only withdrawals have been temporarily frozen.
Technical analysis shows the attackers never obtained private keys. Instead, they submitted fabricated internal transfer requests that the approval system accepted. This “forged withdrawal slip” approach exploited weaknesses in human and process controls rather than cryptographic protections.
Gracy Chen directly linked the operation to North Korean actors, citing matching IP addresses, VPN preferences, behavioral patterns, and on-chain signatures consistent with previous campaigns. The same group is believed responsible for the $1.4 billion Bybit theft in February 2025.
Industry data from Chainalysis and TRM Labs indicate that North Korean-linked thefts accounted for three-quarters of all crypto stolen globally in 2026. The Bitget incident underscores that even air-gapped cold wallets cannot protect against compromised internal approval processes.
Security experts recommend four immediate improvements: mandatory dual-person review with hardware-bound approvals, context-aware anomaly detection for large or unusual transfers, continuous validation of multi-factor tokens, and routine engagement of third-party investigators such as Mandiant and SlowMist.
