Key takeaways
- Bitget detects unauthorized transfers of approximately $351.6M from its hot and warm wallets on September 24.
- Gracy Chen says Bitget's User Protection Fund, holding over $464M, covers the full amount of the loss.
- Chen says attackers compromise a wallet-service backend system to forge transfer authorization rather than obtaining private keys.
Bitget CEO Gracy Chen said the exchange detected unauthorized transfers of approximately $351.6M from its hot and warm wallets at 18:31 UTC on September 24, 2026. Chen said cold wallets remain fully secure and user funds are safe, and that the full amount of the loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464M.
Deposits and trading continued normally while Bitget temporarily suspended withdrawals as a precautionary measure.
What the Attackers Reached
Bitget operates a three-tier wallet architecture, and the breach contained only a portion of the hot wallet and warm wallet layers, according to Bitcoin Magazine. The cold wallets, the third tier, remain fully secure, Chen said.
Chen said attackers compromised a wallet-service backend system to forge transfer authorization. According to Chen, the attackers did not forge user withdrawal requests and did not obtain the private keys of the cold wallet or any hot or warm wallet.
In other words, the approximately $351.6M left the hot and warm wallets because attackers compromised the wallet-service backend system that authorizes transfers, not because the private keys of the cold wallet or any hot or warm wallet were taken.
Which assets moved is not settled. Bitcoin Magazine noted that Arkham's dashboard did not list Bitcoin among the moved assets, while Hacken said BTC was moved.
A Preliminary North Korea Link
Chen told Cointelegraph that Bitget identified some IP addresses that match the VPN choices of a certain DPRK group:
"We've identified some IP addresses that match the VPN choices by a certain DPRK group."
That IP and VPN match is a preliminary finding pointing to a North Korea-linked group, not a confirmed attribution. Chen presented the North Korea link as a suspicion based on the IP addresses and VPN choices Bitget identified.
Chen framed the incident around the User Protection Fund, which currently holds over $464M and, by Chen's account, covers the full amount of the approximately $351.6M loss.
Why It Matters
Bitget kept its cold wallets fully secure and holds a User Protection Fund of over $464M, yet customers still saw withdrawals temporarily suspended while deposits and trading continued. That pause shows what exchange custody means in practice, because once attackers compromised a wallet-service backend system to forge transfer authorization, every customer's access to bitcoin depended on when Bitget chose to reopen withdrawals. A protection fund that covers the full amount of the loss is still a promise from the same exchange that lost approximately $351.6M from its hot and warm wallets. Bitcoin held in self-custody has no wallet-service backend for a North Korea-linked group to compromise and no withdrawal switch for anyone to suspend.
