On September 24, 2026, Bitget detected unauthorized transfers totaling about $351.6 million across multiple cryptocurrencies including ETH, XRP, BNB, AVAX, USDT, and USDC. The attacker exploited a critical backend system within Bitget's wallet infrastructure to approve fraudulent transfers without accessing private keys. The funds were taken from hot wallets; cold wallets were not compromised. Bitget's CEO indicated that the attack patterns and IP behavior are consistent with North Korean state-sponsored hacker groups, though no specific group was named. Some blockchain foundations have frozen wallet addresses linked to the attacker. The incident has been reported to authorities, and cybersecurity firms Mandiant and SlowMist are assisting with the investigation.

The attacker successfully transferred approximately $351.6 million in cryptocurrency from Bitget's hot wallets, impacting multiple blockchain assets, with XRP suffering the largest loss on a single chain. The compromise affected Bitget's backend wallet infrastructure but did not involve private key theft or cold wallet compromise. The incident represents a significant financial loss and potential reputational damage to Bitget. Some attacker-linked wallet addresses have been frozen, potentially limiting further fund movement.

Bitget's security systems detected and halted unauthorized transfers promptly, and some attacker-linked wallet addresses have been frozen by blockchain foundations. The company is investigating the root cause with external cybersecurity experts. No private keys were compromised, and cold wallets remain secure. Users of Bitget Wallet, which operates on separate infrastructure, were not affected. Stakeholders should monitor official updates from Bitget and relevant authorities. Patch status is not applicable as this is an incident involving operational security compromise rather than a software vulnerability.