The biggest crypto theft of 2026 didn't require stealing a single private key. According to Bitget, attackers simply convinced the exchange's own systems to sign the withdrawals for them. The result: somewhere between $351.6 million and $387.5 million gone, withdrawals frozen for days, and another reminder that "exchange risk" is not a theoretical line item.
What happened
- When: Bitget said suspected North Korean threat actors stole funds from its hot and warm wallets on September 24, 2026, at 18:31 UTC, according to The Hacker News.
- How much: the initial figure was $351.6 million, reported by CNBC on September 25. Bitget later raised it to $387.5 million based on further on-chain tracing, according to BleepingComputer and The Block.
- What was taken: ETH, XRP, BNB, AVAX, USDT and USDC across Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base.
- The method: Bitget said the attacker breached a critical backend system within its wallet infrastructure, used it to spoof transaction data, and triggered the exchange's own authorization-signing process. Private key compromise was ruled out. BleepingComputer's report describes the attacker exploiting a vulnerability in a third-party security product to obtain high-level internal credentials.
- Attribution: CEO Gracy Chen blamed North Korean hackers, citing on-chain analysis and IP address patterns linked to VPN services previously used by a North Korean group, per CNBC. Bitget brought in Google-owned Mandiant and SlowMist for a third-party investigation. Attribution is Bitget's assessment and has not been confirmed by authorities in the reports reviewed.
Withdrawals frozen, then a phased restart
Bitget halted user withdrawals while spot trading and deposits continued. Chen said withdrawals could return within hours or days, but "shouldn't take weeks," according to reports. The exchange then announced a phased restart: Bitcoin withdrawals resumed at 08:00 UTC on September 28, with Ethereum scheduled for September 29, USDT for September 30, and other tokens, fiat and P2P services expected by October 2.
Bitget says the loss falls within its User Protection Fund, which holds over $464 million, and that user account balances are unaffected. TokenPost calculated that the original $352 million figure alone could consume about 76% of that fund.
Why futures traders should care
Plenty of futures traders also trade crypto perpetuals on offshore exchanges, or keep margin there because the leverage is higher and the onboarding is easier. The Bitget incident is a clean illustration of the risk you're taking that has nothing to do with your trade: the venue itself. Your position can be right and your money can still be stuck.
It also highlights how modern attacks work. Nobody "cracked" Bitget's cold storage. According to the exchange, attackers compromised a backend system and fed it false data, so the approval process did exactly what it was built to do: approve. The same class of risk applies to any platform where internal systems sign off on money movement.
The controversy: both sides
The defense: Bitget disclosed quickly, named investigators, said a protection fund covers the loss, and began restoring withdrawals within about four days. By crypto-exchange standards, that's a relatively orderly response, and users' balances, per Bitget, are whole.
The criticism: the headline number grew by roughly $36 million after the first disclosure, withdrawals were frozen while deposits stayed open, and the protection fund's capacity to absorb another event of this size is now much smaller. According to The Hacker News, if the theft is confirmed as North Korean, 2026 becomes the second-largest year on record for North Korean crypto theft, at $1.04 billion, behind 2025's $1.68 billion. The industry keeps losing this fight.
Our take
Our take: Any exchange's "your funds are safe" is a promise backed by a balance sheet you can't audit in real time. Bitget may well make everyone whole, and credit where due for a fast, transparent timeline. But a trader shouldn't need to read a post-mortem to learn whether their margin is reachable. Keeping deposits open while withdrawals are frozen is the part that should bother everyone. It means the platform can keep taking your money at the exact moment you can't take it back.
The uncomfortable question: how much of your trading capital is sitting on a venue where the only thing between you and a frozen account is the strength of someone else's internal approval process?
What traders should do (general, not advice)
- Keep only what you need for active trading on any single exchange.
- Know what protections apply to your account, and what doesn't, before an incident.
- Watch for official withdrawal notices only from the exchange's verified channels; hacks are often followed by phishing.
- Factor venue risk into leverage decisions, not just market risk.
Key takeaways
- Bitget says attackers stole funds from hot and warm wallets on Sept. 24, 2026; the estimate rose from $351.6M to $387.5M.
- Bitget says attackers spoofed data to its signing process via a compromised backend system; private keys were not compromised.
- Bitget blames North Korean hackers; that is the company's assessment.
- Withdrawals resumed in phases starting Sept. 28, with full restoration targeted by Oct. 2; a $464M+ protection fund is said to cover losses.
- Our view: venue risk is real risk; size your exchange balances accordingly.
Put the research to work on your Desk
Explore the tools behind the research, compare the available access, or open your Desk if you already have an account.
FAQ
How much was stolen in the Bitget hack?
Bitget initially reported $351.6 million, later updated to $387.5 million based on on-chain tracing.
When did Bitget resume withdrawals?
Bitcoin withdrawals resumed at 08:00 UTC on September 28, 2026, with ETH, USDT, and other assets scheduled to follow through October 2.
Are Bitget users being reimbursed?
Bitget says the loss is covered by its User Protection Fund, which holds over $464 million, and that user balances are unaffected.
Loomi.Ai provides educational market research, not financial advice. Trading futures and options involves substantial risk of loss, and backtested results are historical and do not guarantee future returns.
Sources
- Crypto platform Bitget suspects North Korea is responsible for $352 million hack, CNBC
- Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise, The Hacker News
- Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist, BleepingComputer
- Bitget starts phased withdrawal resumption following $388 million exploit, The Block
- Bitget's $352 Million Hack Could Consume 76% of Protection Fund, TokenPost
- Bitget suspends withdrawals after hackers take US$352mil, The Star