Bitget hack: $388m stolen, balances intact

Of the almost $388 million that left Bitget's wallets on 24 September, the exchange has so far had $1.1 million frozen. Customers have lost nothing, Bitget says: it is covering the loss from its own protection fund. On 3 October Chainalysis linked the attack to North Korean hackers, which takes their haul for 2026 past $1 billion.

What happened on 24 September

At around 18:31 UTC, unauthorised transactions left part of Bitget's hot and warm wallets, spread across seven networks. A hot wallet is one that stays online so withdrawals can be processed quickly; a warm wallet sits in between. The transactions were signed by Bitget's own wallets, using settings that ordinary customer withdrawals never use.

Early reports put the figure at $352 million. Bitget and CNBC later arrived at almost $388 million. Withdrawals were paused and have been reopening step by step since 28 September.

Were customer balances affected?

No, says Bitget: balances are correct and no customer bears the loss. The exchange is paying it from its User Protection Fund. Before the hack that fund held more than $464 million; it then fell below $200 million and has been topped up with Bitget's own money to more than $300 million.

Two things are worth knowing. The fund is Bitget's own reserve, not a legal guarantee like a bank's deposit guarantee scheme. And the buffer is smaller than before: $300 million covers about 77% of a hack of the same size.

What Chainalysis found

According to Chainalysis, the attackers spread the loot over four blockchains: 49.7% via Ethereum, 40.8% via XRP, 7.6% via Zcash and 1.8% via Tron. The money then moved through cross-chain bridges to make the trail harder to follow. Chainalysis says its in-house AI software cut more than 20 hours of manual work to under 10 minutes.

North Korean groups had already stolen more than $2 billion in crypto in 2025. Bybit, which lost $1.5 billion in 2025, also points to North Korea; Bybit is now taking the country to court.

Will the money come back?

Mostly not, by the look of it. Bitget CEO Gracy Chen told CNBC she is ‘not expecting to recover a lot of funds’. She pointed to Bybit, where about 3.5% of the loot had been frozen after a year. At Bitget, the $1.1 million frozen so far is 0.3% of the total.

The biggest hack of 2026 so far

In early September the Liquid Network hack, at $319 million, was still the largest of the year according to TRM Labs. At Liquid, most of it came back. Bitget, at almost $388 million, is larger, and there it does not look that way.

What to do

If you have funds on Bitget: according to Bitget, you do not need to do anything. Check your balance and expect withdrawals to return in phases.

In general: an exchange is a place to trade, not to store. Whatever you are not actively trading can go into your own custody on a hardware wallet, such as a Blockstream Jade or a BitBox; this is how it works. If you want to know who supervises a platform, check the authorisation yourself or look at our overview of European authorisations. An authorisation does not prevent a hack, but it does tell you who the supervisor is.

Frequently asked questions

Is my money on Bitget safe after the hack?

According to Bitget, yes: customer balances were not affected and the loss is covered by its own protection fund. That fund is smaller after the hack than it was before.

Who was behind the Bitget hack?

Chainalysis attributes the attack to groups linked to North Korea.

What is a hot wallet?

A wallet that stays online so an exchange can process withdrawals quickly. That makes it more vulnerable than a wallet kept offline.

Amounts in US dollars, as reported by Bitget, CNBC and Chainalysis. Sources last checked on 4 October 2026.