Bitget says $351.6 million breach hit hot wallets on September 24, with XRP the largest single-chain loss

Bitget says a security breach on September 24 affected about $351.6 million in digital assets, with abnormal transfers tied to a limited number of hot wallets. For PSPs and exchanges that live and die by wallet architecture, the important part is not just the size of the hit — it is that Bitget says the issue involved backend wallet systems, not private keys.

1. At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limited number of hot wallets. The company said it immediately activated emergency response procedures and began a full investigation.
2. CEO Gracy Chen said on an X livestream that investigators identified IP addresses linked to VPN services previously used by a North Korean hacking group and noted similarities with earlier attacks, although Bitget has not confirmed who was responsible. The technical investigation is being run with Mandiant and SlowMist.
3. Bitget said the incident did not involve a compromise of its private keys. Its preliminary findings point instead to an internal wallet-backend system breach, where transfer data was manipulated before triggering the exchange’s authorization-signing process.
4. Current on-chain reporting puts the affected assets at 102.93M XRP ($157.48M), 31,890 ETH ($85.75M), $34.75M USDT, $21.06M USDC, $19.67M USDT0, 3,000 XAUt ($12.82M), 12,719 BNB ($9.88M), 821,012 AVAX ($8.38M), and 20.59M TRX ($7.07M). Those figures total about $356.86M, slightly above Bitget’s own $351.6M estimate because of pricing and time differences.
5. Chen said the losses are fully covered by Bitget’s User Protection Fund, which holds more than $464 million, and that the breach has been contained. Bitget said its cold wallets and the overwhelming majority of platform assets remain secure and unaffected, while withdrawals were temporarily suspended for security checks; deposits and trading remain operational.

For high-risk operators, this is the familiar split-screen: hot-wallet exposure on one side, customer-fund messaging on the other. Bitget is drawing a hard line between affected operational wallets and protected user balances, which is exactly the distinction counterparties, acquirers, and banking partners will want to test when they review treasury controls.