Bitget, one of the world's largest cryptocurrency exchanges, has begun restoring customer withdrawals in stages starting September 28, more than three days after attackers drained an estimated $387.5 million from the platform's hot and warm wallets. The incident is now the largest crypto exchange hack of 2026, and Bitget's leadership says the evidence points toward North Korean state-linked hackers.
What Happened in the Bitget Hack
Bitget's security systems flagged unauthorized transfers moving out of several hot wallets at 18:31 UTC on September 24. Attackers moved funds across Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base, according to on-chain analysis firm TRM Labs. The largest single holding stolen was roughly 103 million XRP, worth close to $157 million at the time, followed by nearly 32,000 ETH worth about $86 million. After accounting for additional Zcash and TRON balances left out of the initial tally, Bitget raised the total loss to $387.5 million.
How Attackers Bypassed Bitget's Wallet Security
Bitget says its private keys were never compromised. Instead, according to a report from The Hacker News, attackers broke into a backend system connected to the exchange's wallet infrastructure and manipulated the transaction data shown to its internal authorization process. That let fraudulent withdrawal requests look routine enough to be approved automatically, without ever touching the private keys that secure the wallets themselves.
Why Bitget Suspects North Korea
Bitget CEO Gracy Chen said North Korean involvement is "very likely," citing IP addresses in the company's preliminary investigation that trace back to VPN services associated with a known North Korean hacking group. Investigators have also linked some of the stolen XRP and ETH to wallet clusters used in earlier DPRK-attributed exploits. Blockchain analytics firm Elliptic estimates the Bitget theft pushes North Korea's total crypto theft for 2026 past $1 billion. Bitget has brought in Google-owned Mandiant and SlowMist for an independent third-party investigation and launched a Recovery Bounty Program to help track and freeze the stolen assets.
Bitget's Phased Withdrawal Schedule
Rather than reopening everything at once, Bitget is restoring withdrawals network by network. According to crypto.news, the rollout runs as follows:
- September 28, 08:00 UTC — Bitcoin network withdrawals reopen first.
- September 29, 08:00 UTC — Ether withdrawals resume across Ethereum, BNB Smart Chain, Arbitrum, Base, and Optimism.
- September 30, 08:00 UTC — USDT withdrawals return across Ethereum, BNB Smart Chain, Solana, and TRON.
- October 2, 08:00 UTC — All remaining tokens, fiat services, and peer-to-peer transfers are scheduled to reopen.
Bitget says users do not need to take any action ahead of each phase; withdrawal availability will simply appear on the platform as it opens.
What This Means for Bitget Users and the Wider Market
Bitget's User Protection Fund holds more than $464 million, and the exchange says it will absorb the full loss, meaning customer balances are unaffected even though the stolen assets themselves are gone. Prices of the tokens most exposed in the breach, including XRP and ETH, held up relatively well in the days after the hack, though the incident adds to a growing list of 2026 exchange breaches that has kept security top of mind across the industry. Traders tracking the fallout can follow live moves on CryptoCloudNews Markets, and the latest developments will continue to be covered in our crypto news section as Bitget's investigation progresses.
Frequently Asked Questions
Did Bitget customers lose money in the hack?
No. Bitget says its User Protection Fund, which holds more than $464 million, will cover the entire $387.5 million loss, so customer account balances remain intact.
What caused the Bitget hack?
Attackers compromised a backend system tied to Bitget's wallet infrastructure and spoofed transaction data to trick its authorization process into approving fraudulent withdrawals. Bitget says its private keys were not stolen.
When will all Bitget withdrawals be back to normal?
Bitget's phased plan restores Bitcoin withdrawals first on September 28, followed by Ether-based networks on September 29, USDT on September 30, and full restoration of all remaining tokens and fiat services by October 2.