Bitget: a backend compromise, not a stolen key, drains ~$387.5M via spoofed transfers

Executive Summary

On September 24, 2026, at 18:31 UTC, the cryptocurrency exchange Bitget's monitoring systems flagged a burst of unauthorized transfers leaving a limited set of its hot wallets.¹² The exchange initially put the loss at $351.6 million; over the following days, as stolen assets were traced onto additional chains including Zcash and TRON, Bitget revised the figure upward to roughly $387.5 million.²³ It is, on the numbers reported, the largest disclosed cryptocurrency theft of 2026 to date.⁴

What makes this incident notable is not the size but the method. Bitget's chief executive, Gracy Chen, was explicit that this was not a stolen-key theft: "Private key compromise has been ruled out."⁵ Instead, she said, "the attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out."⁵ Chen's own analogy was that it was "the digital version of slipping forged withdrawal slips through a bank's own teller window" — the attackers did not forge a signature, they got into the system that prepares and submits transfer requests and fed the exchange's own approval workflow paperwork that looked legitimate.⁵ The authorization machinery processed the forged requests as real, and funds drained from the hot and warm wallets. The cold wallets, and the separate self-custodial Bitget Wallet product, were untouched.¹⁵

The attribution is suspected, not confirmed. Chen described the intrusion as "highly consistent with known patterns of North Korean hacker organizations," citing IP behaviour patterns and on-chain analysis; no government or independent body had publicly confirmed a DPRK link as of this writing.¹⁴ The broader context is real — the blockchain-intelligence firm TRM Labs assesses that North Korea is behind roughly three-quarters of all cryptocurrency thefts in 2026 to date — but that is a statement about the year, not a forensic finding about this specific heist.⁴

For users, the practical outcome was contained. Bitget halted all withdrawals on discovery, said the entire loss fell within its User Protection Fund (which holds over 5,500 BTC, worth roughly $464 million), and began a phased resumption of withdrawals on September 28, 2026, at 08:00 UTC after identifying and addressing the vulnerability.¹² Customer balances, the exchange said, were untouched. The engagement of Mandiant and SlowMist alongside law enforcement to run the forensics is the part still in progress; the exact intrusion vector into the backend system has not been publicly disclosed.¹

Verification of Claims

1. Claim: North Korean hackers stole the funds from Bitget. → Assessed, not confirmed → The only attribution on record is Bitget CEO Gracy Chen's statement that the breach is "highly consistent with known patterns of North Korean hacker organizations," based on IP behaviour and on-chain analysis. No government or independent forensic body has publicly confirmed DPRK involvement in this specific incident; TRM Labs' figure that North Korea is behind ~75% of 2026 crypto theft is context, not case-specific evidence.¹⁴⁵

2. Claim: Bitget lost $351.6 million. → Superseded → $351.6 million was the initial figure Bitget disclosed and the number most headlines repeated. Bitget subsequently revised the loss upward to approximately $387.5 million as stolen assets were traced onto Zcash and TRON. The $351.6M figure is not wrong so much as an early, incomplete count.²³

3. Claim: The attackers did not compromise Bitget's private keys. → Verified (per Bitget) → CEO Gracy Chen stated directly that "private key compromise has been ruled out," and described the mechanism as a compromise of the backend system that prepares and submits transfers, which was used to spoof transaction data and drive the authorization process. This is the exchange's own finding; the independent forensics by Mandiant and SlowMist were still ongoing.¹⁵

4. Claim: This is the largest cryptocurrency theft of 2026 so far. → Weak evidence → The "largest of the year" framing is asserted by reporting rather than sourced to an independent tally, and the loss figure itself moved from $351.6M to ~$387.5M during the disclosure. It is plausibly true — it eclipses a ~$340M September incident — but rests on an unverified running total, so it should be read as a strong likelihood, not a confirmed record.²⁴

Timeline

Attack Anatomy

Entry — an undisclosed intrusion into the wallet backend

The initial access vector has not been publicly disclosed. What Bitget has confirmed is the destination: attackers reached "a critical backend system within our wallet infrastructure" — the system that prepares and submits transfer requests, not the key material that signs them (T1078 is a plausible but unconfirmed route; Bitget has not said how the backend was reached).⁵

Spoofing the transaction data

Rather than forging cryptographic signatures, the attackers manipulated the data flowing through the transfer-preparation system, generating forged transfer requests that the exchange's own approval workflow would accept — runtime manipulation of the authorization pipeline rather than theft of a signing key (T1565.003).⁵

Draining hot and warm wallets

The forged requests were pushed through the authorization process, which processed them as legitimate and released funds from Bitget's hot and warm wallets across multiple chains — Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base, and later Zcash and TRON — for a total the exchange ultimately put near $387.5 million (T1657). Cold wallets and the self-custodial Bitget Wallet were not affected.¹²⁵

Threat Actor Profile

• Attacker: Unconfirmed. Bitget attributes the intrusion to suspected North Korean actors at the level of an assessment — "highly consistent with known patterns of North Korean hacker organizations" — based on IP behaviour and on-chain analysis, but no group is named and no government or independent body has publicly confirmed the link.¹⁵
• Attribution confidence: Low to medium, and entirely from the victim. The supporting context — TRM Labs' assessment that DPRK actors account for roughly three-quarters of 2026 crypto theft — describes the year's threat landscape, not this case.⁴
• Objective: Direct financial theft. DPRK-linked crypto operations characteristically target exchange infrastructure to fund the state, and prefer methods that abuse trusted internal systems over brute cryptographic attacks — consistent with, though not proof of, what is described here.⁴⁵
• Method signature: Compromising the backend that authorizes transfers, rather than stealing keys, echoes the pattern seen in other large 2025–2026 exchange thefts where the weak point was an internal approval or signing workflow rather than the cryptography itself.⁵

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

incident:
  exchange: "Bitget"
  disclosed_loss_initial_usd: "351.6 million"
  disclosed_loss_revised_usd: "~387.5 million"
  discovery: "2026-09-24 18:31 UTC"
  wallets_affected: "hot and warm"
  wallets_safe: "cold wallets; self-custodial Bitget Wallet"
  chains_touched:
    - Ethereum
    - "XRP Ledger"
    - Arbitrum
    - Avalanche
    - Optimism
    - BSC
    - Base
    - Zcash    # stolen assets later traced here
    - TRON     # stolen assets later traced here
  assets: ["ETH", "XRP", "BNB", "AVAX", "USDT", "USDC"]
  mechanism: "backend wallet-infrastructure compromise -> spoofed transaction data -> forged transfers pushed through authorization workflow; private keys not compromised"
network_iocs: "No attacker wallet addresses or infrastructure IOCs were published in the sources reviewed; the theft was traced on-chain by Mandiant and SlowMist, whose forensic report was pending. Treat exchange-published addresses, when released, as the authoritative IOC set."

Legal and Regulatory Response

No indictment, sanctions action, or government advisory specific to this incident had been published as of this writing; the disclosure and attribution are the exchange's own, with forensic support from Mandiant and SlowMist and unspecified law-enforcement engagement.¹ Bitget stated that the loss falls entirely within its User Protection Fund, so the regulatory and customer-restitution exposure is, on the exchange's account, absorbed internally rather than passed to users.² Whether any national authority formally attributes the theft to a DPRK unit — as has happened with prior large exchange heists — remains open and would be the point at which "suspected" becomes "confirmed."

Impact Assessment

• Confirmed (per Bitget): A backend compromise of Bitget's wallet infrastructure was used to spoof transaction data and push forged transfers through the exchange's authorization workflow, draining hot and warm wallets across nine chains for a loss the exchange ultimately put near $387.5 million (initially $351.6 million).¹²⁵
• Confirmed: Private keys were not compromised; cold wallets and the self-custodial product were unaffected; withdrawals were halted on discovery and resumed in phases from September 28; the User Protection Fund (~$464M) covers the loss.¹²⁵
• Assessed: North Korean involvement is suspected on the strength of the victim's IP-behaviour and on-chain analysis, uncorroborated by any government or independent forensic body at the time of writing.¹⁴
• Unknown: The initial-access vector into the backend system; the identity of any specific threat group; the laundering path; and the findings of the pending Mandiant/SlowMist forensics.¹

Lessons and Defensive Recommendations

For exchanges and custodians:

• The signing key is not the only thing worth protecting. This theft treated the transaction-preparation and authorization pipeline as the target, feeding forged-but-well-formed requests into a workflow that trusted its own inputs. Authorization systems should independently validate that a transfer request originated from a legitimate, authenticated source and matches expected patterns (amount, destination, velocity) — not merely that it is well-formed. Out-of-band or multi-party confirmation for large hot/warm-wallet movements raises the bar past "compromise one backend."
• Segment and monitor the backend that constructs transfers as tightly as the key store. An attacker who can inject into the transfer-preparation system does not need the keys; the two must be defended as one blast radius.

For the wider ecosystem:

• A funded protection reserve is what turned a $387.5M theft into a contained incident for users. Exchanges that hold customer assets should be able to answer, before an incident, whether a loss of this scale is covered and how — the presence of Bitget's User Protection Fund is why customer balances were reported untouched.
• Treat single-source attribution with proportion. "Highly consistent with North Korean patterns" from the victim is a reasonable working hypothesis given DPRK's documented dominance of 2026 crypto theft, but it is not the same as a forensic or government attribution, and readers should hold the DPRK label as suspected until an independent body confirms it.

For readers:

• The headline number moved. The $351.6M figure that circulated first was an early count; the fuller figure is ~$387.5M. When an exchange discloses a loss in the first hours, expect the number to change as on-chain tracing catches assets on additional chains — the first figure is a floor, not a final.

Sources