Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances
Bitget exchange hot and warm wallets
Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund.
Why this severity: $388M reported stolen.
- Started
- Sep 24, 2026
- Reported stolen
- $388M
At risk
- Bitget exchange hot and warm wallets
- Ethereum wallets
- Arbitrum wallets
- Avalanche wallets
- Optimism wallets
- BNB Chain wallets
- Base wallets
What to do now
- Check your balance only by logging in through the app or bookmarked site you normally use.
- Ignore emails, DMs, ads or posts offering 'compensation claims', 'refunds' or 'wallet re-verification'. Never connect a wallet or enter a seed phrase to claim anything from an exchange.
Stay safe
Am I affected?
Bitget account holders: the theft hit the exchange's own hot and warm wallets, and reports say the loss was covered by Bitget's protection fund. Self-custody wallets were not touched.
What to do now
- Check your balance only by logging in through the app or bookmarked site you normally use.
- Ignore emails, DMs, ads or posts offering 'compensation claims', 'refunds' or 'wallet re-verification'. Never connect a wallet or enter a seed phrase to claim anything from an exchange.
How to avoid this
- Keep only your active trading balance on any exchange and hold the rest in self-custody.
- Turn on withdrawal-address allowlists and app-based 2FA, and bookmark the official site.
Timeline 6
Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.
SourceThe confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.
SourceBitget resumed Bitcoin withdrawals.
SourceA custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.
SourcePer Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.
SourceSlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.
Source
News & write-ups ›4
- Bitget hacked via zero-day in third-party security productsBleepingComputer · Sep 30, 2026
- Bitget resumes Bitcoin withdrawals after $387.5 million crypto heistBleepingComputer · Sep 28, 2026
- Crypto loses $768M in worst hack month of 2026crypto.news · Oct 1, 2026
- Bitget, Liquid exploits push Q3 crypto hacks toward $1.2BCointelegraph · Oct 15, 2026
Follow new drains and updates in your feed reader or Telegram RSS bot.