Update, September 26: Bitget raised the loss to about $387.5 million after finding stolen assets on Zcash and TRON. Withdrawals restart in phases from September 28. Private key compromise ruled out. Full incident report still pending.
Update, September 24: Bitget confirmed the hack, losses approximately $350 million. CEO Gracy Chen says user funds are safe.
Was Bitget hacked? Yes. On September 24, 2026, an attacker drained around $387.5 million from Bitget’s hot and warm wallets across seven networks. Bitget says user balances are untouched and its Protection Fund will cover the loss. Withdrawals have been paused since the attack and reopen in stages from September 28, starting with Bitcoin. Here’s the full timeline, what Bitget has said so far, and what to do if you have funds on the exchange.
What Happened at Bitget on Thursday
The first warning came from Arbitrum. A brand-new wallet starting with 0xe410 spent 19.67 million USDT0 on ETH. It bought 7,111 ETH in six minutes. The USDT0 came straight from a Bitget hot wallet.
Soon after, trackers spotted a much bigger picture. Several Bitget wallets sent assets to a single address. The flows covered ETH, USDT, USDC, AVAX, BNB and more, across several chains. Estimates climbed from $100 million to $170 million, then to around $183 million on EVM chains alone.
Around the same time, users started posting about failed withdrawals. Bubblemaps, Wu Blockchain, The Block and Decrypt all flagged the activity within the hour. Bitget’s own team detected the breach at 18:31 UTC and confirmed the hack later that day.
How the Attacker Moved the Money
The on-chain trail shows an attacker in a hurry. Three details stood out before Bitget said a word.
First, look at the price. The 0xe410 wallet bought ETH through UniswapX and 1inch Fusion. It paid up to 5% above the market price. The WETH/USDC pool on Arbitrum briefly printed $2,870. A treasury desk would never eat that much slippage on purpose.
Second, look at what got sold. Tether and Circle can freeze stablecoins at the contract level. ETH has no such off switch. Someone rushing to dump stablecoins for ETH is trying to beat a freeze. They mostly succeeded. The two issuers froze only about $318,000 in USDT and USDC tied to the attacker.
Third, the receiving address carried no Bitget label. It also started splitting funds to six more wallets almost right away. That fan-out is a classic first laundering step.
Where the $387 Million Figure Comes From
The number grew as the review widened. On September 24, Bitget put the loss at about $351.6 million. That covered EVM chains, where around $183 million left, and the XRP Ledger, where two Bitget wallets sent 93.7 million XRP, worth roughly $143 million, to a fresh address.
On September 26, Bitget raised the figure to about $387.5 million. The new total adds stolen assets found on Zcash and TRON that the first review missed. Seven networks are affected in total. Bitget says the number could still move as forensic work continues.
One correction to early reports: Bitget says its cold wallets were not touched. The attacker breached a backend wallet system, spoofed transfer information and triggered the authorization-signing process. Private key compromise has been ruled out. The exact intrusion method is still under investigation, with Mandiant and SlowMist working alongside Bitget’s team and law enforcement now involved.
When Do Bitget Withdrawals Reopen?
Bitget published a phased schedule on September 26. Deposits and trading have continued throughout.
- September 28, 08:00 UTC: Bitcoin withdrawals reopen
- September 29: Ethereum withdrawals reopen
- September 30: USDT withdrawals reopen
- By October 2: all remaining tokens, fiat and P2P restored
Bitget says the vulnerability has been identified and fixed, and the pause is a security measure rather than a sign of missing user funds. Each phase depends on validation checks passing, so watch the platform for live availability. A public AMA is scheduled for September 28.
The Addresses Everyone Is Watching
These are the wallets on-chain trackers flagged. You can follow them on any explorer.
- Main destination: 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee
- Arbitrum ETH buyer: 0xe410a2E5710Ee787bcaa63f52A3943ff71F0d946
- 0x469Ac1406dE92f82C0563477240a3627057425DC
- 0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899
- 0x7c96279Ec1e888Aa56b9B836e0dB26ca48573E1C
- 0x94A43df7687A8494948Be937400e9d5D33135DA0
- 0xA6dD3F218B65E32Ccc37BE30f74884133c655545
Bitget now runs a live fund-tracing dashboard and a real-time API tracking attacker addresses. It also launched a bounty: 5% of any funds frozen and 5% of any funds recovered go to whoever helped. Bybit’s LazarusBounty platform is a core channel for the hunt. Gracy Chen has said a North Korean group is the likely culprit, and one analyst linked the stolen XRP to Lazarus flows from an earlier hack. Attribution remains unconfirmed.
What Bitget Users Should Do Right Now
Don’t click random links. Scammers love hack days. Fake “Bitget refund” pages and phishing DMs usually appear within hours. Bitget will never ask for your password, 2FA codes or seed phrase.
Next, check Bitget’s official X account and announcement center only. Ignore screenshots of “statements” from random accounts.
Once withdrawals reopen for your assets, I would get my funds out. There is no upside in waiting. Send funds to your own wallet and double-check every address before you confirm.
Bitget says user funds are safe, and so far its actions back that up. Still, a promise is not a withdrawal. Get your coins out first, and redeposit later if you want.
This is also a good moment to revisit where your long-term coins live. We weighed the trade-offs in our self custody vs exchange breakdown. If you decide to hold your own keys, our guide on how cold wallets secure your crypto covers the basics.
Bitget Alternatives: Six Head-to-Heads
Plenty of users are shopping for a new venue this week. Rather than guess, compare Bitget against the exchanges its traders actually move to. We have six head-to-heads ready, updated with the hack factored in:
- Bitget vs Hyperliquid: the self custody route, for traders who never want an exchange holding their coins again
- Bitget vs MEXC: near-zero fees and the biggest altcoin catalog, with MEXC’s own freeze risk explained
- Bitget vs Blofin: same futures fees, lighter KYC, and a clean security record
- Bitunix vs Bitget: 200x leverage and optional KYC from a younger exchange with no breaches
- OKX vs Bitget: MiCA licensing and the best Web3 wallet of any CEX
- Bybit vs Bitget: the exchange that already survived a bigger hack and paid everyone back
Each one links the full review of both exchanges, so you can go as deep as you need before moving funds.
Bitget’s Security Track Record
This is not Bitget’s first big loss. In April 2025, a small group of accounts exploited a flaw in its market-making bot on the VOXEL market. That incident cost about $100 million. Bitget said user spot and futures balances stayed intact.
The VOXEL loss came from a trading-logic bug, not wallet access. This time the attacker got into the signing flow itself, which is a different kind of problem.
In February 2025, Bitget lent 40,000 ETH to Bybit after the $1.5 billion Bybit hack. Bybit repaid it within three days. Bybit CEO Ben Zhou returned the favor within hours of this attack, offering his team’s help. Exchanges tend to back each other on days like this.
Bitget also runs a Protection Fund backed by 5,500 BTC. Gracy Chen says it now holds more than $464 million, enough to cover the loss with room to spare. Bitget has confirmed the fund will absorb the damage. That’s the difference between an ugly week and a catastrophe.
For our earlier exchange reviews and comparisons, see our Bitget coverage.
Keep This Content Free
Hack days are a reminder that no single exchange should hold everything. Spreading funds across venues limits the damage when one of them has a bad day. Opening a second account? Use our OKX link or our Bybit link. You get the sign-up bonus, and we earn a small commission. That keeps AirdropAlert free.
Final Words
Two days in, Bitget’s handling looks competent. It confirmed the hack within hours, found and fixed the bug, published a withdrawal schedule, and committed its Protection Fund to cover the loss. The number climbed to $387.5 million, and the attacker got most of it into ETH before anyone could freeze it. Still, no user has lost a balance, and withdrawals start returning on September 28.
The full incident report with a root cause is the next thing to watch. We’ll update this post as it lands. Until then, avoid phishing links, withdraw once your assets reopen, and don’t treat any exchange as a savings account.
FAQ
Was Bitget hacked?
Yes. On September 24, 2026, an attacker breached a backend wallet system and moved about $387.5 million out of Bitget’s hot and warm wallets across seven networks. Bitget confirmed the hack the same day.
How much did the Bitget hacker steal?
About $387.5 million. Bitget first estimated $351.6 million, then raised it on September 26 after finding stolen assets on Zcash and TRON. The figure may still change.
When do Bitget withdrawals reopen?
In phases. Bitcoin on September 28 at 08:00 UTC, Ethereum on September 29, USDT on September 30, and all remaining tokens, fiat and P2P by October 2.
Are Bitget user funds safe?
Bitget says yes. User balances are unaffected, and its Protection Fund of more than $464 million will cover the loss. Withdrawals are paused for security checks, not because funds are missing.
Is the Bitget Wallet app affected?
Nothing so far links the incident to the Bitget Wallet self-custody app. The breach hit the exchange’s own wallet infrastructure.
Who hacked Bitget?
Unconfirmed. CEO Gracy Chen has said a North Korean group is likely, and one analyst tied the stolen XRP to earlier Lazarus flows. Mandiant and SlowMist are still investigating.
Should I withdraw my funds from Bitget?
Yes. I would withdraw as soon as your assets reopen. You can always deposit again once things settle. A confirmed hack can trigger a bank run, and exchanges have frozen withdrawals under that kind of pressure before.
