The official notice from Bitget regarding the security breach says that its systems noticed the transaction at 18:31 UTC and took emergency action instantly. It also stated that around $351.6 million ( roughly Rs. 3,369 crore) worth of funds were affected and that the incident impacted its hot and warm wallet layers. The cold wallets were secure according to Bitget’s three-tier classification system internally. Bitget added that its initial investigation into the wallet breach shows no leak of any private keys despite the withdrawal of funds without permission on September 24, 2026.
Bitget Traces Attack to Its Backend Wallet Infrastructure
After the breach, deposits and trades were kept operational, but withdrawals were not allowed. According to Bitget, the user balances were correct, and the company’s User Protection Fund, which is worth more than $464 million (roughly Rs. 4,446 crore), would be able to pay for any potential losses. Law enforcement authorities as well as blockchain-based security firms have been informed of the issue, while addresses tied to the abnormal transfers have been flagged.
In terms of value, Lookonchain listed XRP of 102.93 million at a valuation of $157.48 million (roughly Rs. 1,509 crore) as the biggest portion of holdings that were compromised. The rest consisted of 31,890 ETH worth about $85.75 million (roughly Rs. 822 crore), 34.75 million USDT, 21.05 million USDC, 19.67 million USD₮0, 3,000 XAUt, 12,719 BNB, 821,012 AVAX, and 20.59 million TRX.
Gracy Chen, the CEO, announced during a live Q&A session following the incident that no private key leak from the company’s cold, warm, and hot wallets was used by hackers through which they could have obtained access to Bitget. The attackers gained access to Bitget’s servers and moved funds directly, without the use of any customer withdrawal requests.
According to another report from the same live session, the security team at Bitget was able to trace one of the vectors of attack. The report revealed the compromise of the backend wallet service of Bitget, whereby there was injection of fake transfer information into the exchange’s signature approval process. There is no technical evidence provided by Bitget for this claim yet.
North Korea was suggested as one possible culprit by Chen when she was responding to questions during her Q&A session, but she was careful to refrain from making definitive claims regarding who had actually carried out the attack. She claimed that there were IP addresses discovered by the investigation which were linked to a certain North Korean hacking organisation’s chosen VPN. We’ve identified some IP addresses that match the VPN choices by a certain DPRK group,” Chen said.
The possible North Korean link comes as the crypto industry faces wider scrutiny over its crypto and DeFi activities. Security researcher Taylor Manonan has claimed that North Korean IT workers have been infiltrating DeFi platforms for the past 7 years. This includes over 40 DeFi platforms, which she listed in a post on X. She further added that seven years of DeFi experience on their resumes is not a lie, cause they have built all the critical protocols that run on each of these DeFi platforms.
