Bitget Hack Losses Reach About $387.5 Million as Exchange Pauses Withdrawals

Crypto exchange Bitget has raised its estimate of the assets taken in Thursday’s breach to about $387.5 million, making it the largest crypto hack reported so far this year. The Seychelles-based exchange, one of the ten biggest by trading volume, says customer balances are covered by its User Protection Fund, but withdrawals remain suspended while the investigation continues.

The incident is a reminder that even large, well-funded centralized platforms remain prime targets, and it comes as attackers suspected of working for North Korea continue to drain record sums from the industry.

What happened

Bitget’s systems flagged unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24, according to the exchange. Withdrawals were halted across the platform as the team worked to contain the breach.

Within roughly an hour of the first transfers, onchain investigators had counted about $183 million in outflows, according to Decrypt. When Bitget confirmed the breach hours later, it put the affected assets at $351.6 million. A security update on Friday raised that figure to approximately $387.5 million after further tracing found affected assets on Zcash and TRON that weren’t included in the first count.

The stolen funds moved across at least five blockchains and included stablecoins, ether and other tokens. Decrypt reported that the largest single portion was about 103 million XRP, worth roughly $157 million at the time.

Spoofed data, not stolen keys

Bitget CEO Gracy Chen said the attackers didn’t steal private keys. Instead, they “compromised a critical backend system within our wallet infrastructure” and used it to spoof transaction data, so that the exchange’s own approval process signed off on payouts that looked routine, as reported by CoinDesk. “Private key compromise has been ruled out,” Chen wrote on X.

Chen said the breach reached both hot and warm wallets, while offline cold wallets “remain fully secure.” She also said the outflow had been stopped: “Loss containment is confirmed. No further unauthorized transfers are possible.” How the attackers first got into Bitget’s systems is still being investigated, and Chen said a full technical report will follow.

That distinction matters. Many large exchange hacks in recent years have involved compromised signing keys or tampered signing interfaces. An attack that manipulates the data feeding an exchange’s authorization system points to a different weak spot: the internal infrastructure that sits between customer requests and the wallets themselves.

Customers and the protection fund

Bitget says users won’t bear the loss. Its User Protection Fund held more than $464 million before the hack and will cover the shortfall in full, according to the company. “User funds are safe,” Chen said.

Deposits and trading have stayed open, but withdrawals are suspended “as a precautionary measure, pending security review.” Chen declined to give a reopening date, saying the company “will not commit to a window we cannot guarantee.” Decrypt reported that Bitget planned to set out a plan for affected users on September 26.

For users, a frozen withdrawal button is the part of the story that hurts right away, even with a protection fund in place. How quickly and smoothly Bitget restores normal service will shape how the episode is judged.

North Korea under suspicion

Chen said investigators had found IP addresses matching VPN services previously used by a group linked to North Korea, and that the onchain patterns resembled past North Korean operations. She stressed that the attacker’s identity hasn’t been confirmed, and no technical evidence has been made public. Bitget is working with security firms Mandiant and SlowMist, and law enforcement is also investigating, according to Decrypt. Chen added that she personally lost about $80,000 from a wallet outside Bitget to the same group.

If the link is confirmed, it would add to a long list of large thefts tied to North Korea. The biggest remains the $1.4 billion Bybit hack in February 2025, which the FBI later attributed to North Korean hackers. Chainalysis has put North Korea’s crypto haul for 2025 at more than $2 billion.

Muted market reaction

The broader market barely flinched. CoinDesk reported on Friday that altcoins rallied across the board while bitcoin held near $84,000, suggesting traders saw the breach as contained to one platform rather than a sign of wider stress. The fact that Bitget said its protection fund could absorb the full loss without touching customer balances may have helped limit any spillover, since there was no immediate question of user losses or a shortfall at the exchange.

Still, the hack is likely to put fresh focus on how exchanges protect the systems around their wallets, not just the keys themselves. Bitget’s final technical report, and whether investigators can freeze or recover any of the stolen funds as they move across chains, will be the next things to watch.