Bitget Hacked for $351.6M: What to Do

On the evening of September 24, Bitget's security systems flagged unauthorized transfers from a portion of its hot wallets. According to CEO Gracy Chen's preliminary estimate, the damage totals roughly $351.6 million — per industry outlets including CNBC, this is the largest centralized exchange hack of 2026.

How the Hack Happened

The incident was logged at 18:31 UTC. According to Chen, attackers compromised the internal system that prepares transfers, falsified transaction data, and the exchange's own approval system let the withdrawal through. That's an important distinction from the classic "stolen hot-wallet private key" scenario: here, the wallet itself wasn't compromised — the internal transaction-approval process was, the mechanism the exchange trusts to decide whether a transfer goes through.

Bitget says its cold wallets were not affected and user balances on the platform remain accurate. Withdrawals are suspended for all clients, with no timeline given for resumption. Deposits and trading continue operating normally.

Why North Korea Is Suspected

According to Bitget's preliminary assessment, the attack's signature resembles known North Korean hacking group techniques, including Lazarus Group. The exchange's CEO said investigators found IP addresses linked to VPN services previously used by a North Korean group, and reported the incident to law enforcement and blockchain security firms. Cryptopolitan and CryptoTimes both covered the exchange's statement.

It's worth stressing: this is a preliminary attribution from the exchange itself, not an independently confirmed fact. North Korean groups have for years been among the most prolific actors in crypto theft, responsible for hundreds of millions to billions of dollars across exchange, bridge, and DeFi protocol attacks. No independent confirmation of involvement exists as of publication.

What Happens to User Funds

Bitget says it will cover the loss from its own user protection fund, which held over $464 million at the time of the incident, mostly in bitcoin. That's formally enough to cover the full claimed damage without touching client funds. Whether that holds up in practice can only be confirmed once the investigation officially concludes and withdrawals resume.

The same day, another crypto platform went offline: the casino Duelbits, which lost around $7 million in ETH, USDT, USDC, DAI, and SHIB from its hot wallets, apparently due to a compromised private key. Two different attack vectors against two different platforms within 24 hours — one more reminder that hot wallets remain the industry's main point of risk concentration, regardless of platform size.

What to Do If You Hold Funds on Bitget

The first rule in a situation like this: follow only the exchange's official channels and ignore any third-party "urgent withdrawal instructions" that tend to appear in the hours after a hack goes public. That's a classic phishing pattern feeding off a real incident — the victims are usually people panicking to find a faster way out than the official process.

Second: don't make additional deposits if someone offers to "speed up" your withdrawal for a fee — a legitimate exchange never requires payment like that. If you notice suspicious activity on your account or believe you were targeted by fraud connected to this news, preserve every piece of evidence — screenshots, correspondence, transaction hashes — and seek blockchain analysis before the trail goes cold.

"Funds sitting in a centralized exchange's hot wallet remain the exchange's responsibility, not the holder's, no matter how sophisticated that exchange looks."

KarCrypto performs blockchain tracing of stolen funds, builds the evidence base for filings with law enforcement and international bodies, and helps clients understand what happened if they were defrauded on the back of an exchange hack. Telegram @KarCryptoSupport.