Breach · Vendor Access

Bitget Resumes Bitcoin Withdrawals After $387.5 Million Crypto Heist

September 28, 2026 · 6 min read

At 18:31 UTC on September 24, 2026, Bitget's security systems flagged unauthorized transfers moving out of its hot and warm wallet infrastructure. By the time the dust settled, attackers had moved approximately $387.5 million across seven blockchain networks. Bitget is a Seychelles-based exchange described as one of the largest in the industry, and the scale of this event puts it in rare company. The attack vector was a vulnerability in a third-party security product that allowed the attacker to obtain high-level internal network credentials, then issue fraudulent withdrawal commands that the wallet system accepted as legitimate. Private keys were not stolen, and cold wallets were untouched. The authorization process itself was weaponized from the inside.

What actually happened

Bitget's security team detected the unauthorized transfers within minutes and suspended withdrawals while deposits and trading continued. The initial accounting put losses at $351.6 million, but a revised figure of approximately $387.5 million was published after additional Zcash and TRON transfers that had been missed in the first pass were identified. XRP was the largest single asset taken: on-chain monitor Lookonchain counted approximately 102.93 million XRP, worth around $157 million at the time. The rest of the losses were spread across Ethereum, Arbitrum, Avalanche, Optimism, BNB Chain, and Base.

CEO Gracy Chen described the mechanism during a September 28 livestream: the attacker exploited a vulnerability in a third-party security product, obtained high-level internal credentials from that foothold, and then sent fraudulent withdrawal commands to the wallet system. The backend infrastructure was compromised in a way that allowed transaction data to be spoofed, triggering the authorization process to approve outbound transfers that looked legitimate to the system. Mandiant and SlowMist were brought in to support forensic review and fund tracing.

On-chain analysis from TRM Labs found multiple overlaps with wallets used to launder previous hacks attributed to the TraderTraitor group, which U.S. authorities have linked to North Korea. Funds were rapidly split into fresh wallets and then moved through swap services including THORChain into ETH and BTC. Elliptic identified on-chain connections between XRP from the Bitget exploit and ETH from a prior DPRK-attributed exploit, as well as connections to addresses involved in laundering from the Bybit 2025 exploit. Bitget CEO Gracy Chen stated the attacker was "likely a North Korean group," and blockchain investigator ZachXBT referred to the event as "the Bitget exploit by DPRK." North Korean attribution remains suspected and has not been officially confirmed by law enforcement at the time of writing.

Circle and Tether froze $339,100 in stablecoins linked to the hack. Bitget's User Protection Fund held more than $464 million at the time and was pledged to cover the full financial impact. A phased withdrawal resumption schedule was announced on September 26: BTC came back online at 08:00 UTC on September 28, ETH-network assets followed on September 29, USDT on September 30, and all remaining tokens along with fiat and P2P assets were scheduled for October 2. Bitget also launched a Recovery Bounty Program offering 5% of frozen funds and 5% of recovered funds to anyone who assists through legal channels.

Why this should matter to you even if you don’t run Bitget

If you run infrastructure that depends on a third-party security product sitting in a privileged position near your most sensitive systems, this incident is worth reading carefully. The attack at Bitget did not require the attacker to crack cryptography or steal private keys. It required finding a vulnerability in a vendor product that had been trusted with high-level internal access, then using the credentials obtained from that foothold to issue commands that the target system treated as authorized. That chain of trust is present in most enterprise environments, not just crypto exchanges.

The pattern Elliptic has documented across 2026 is also worth noting. This incident pushes suspected DPRK crypto theft past $1 billion for the year, making 2026 the second-largest year on record for North Korean crypto theft at approximately $1.04 billion, behind 2025's $1.68 billion. Elliptic had already tracked more than 51 DPRK-linked incidents in 2026 before this one. These are not opportunistic attacks against poorly maintained systems. They are targeted, patient, and well-resourced campaigns against organizations that have made security investments. The laundering infrastructure, including the use of THORChain and rapid wallet-splitting, is mature and practiced.

The third-party access question is also one that cyber insurers are paying close attention to. Policies written before the current wave of vendor-access incidents often have ambiguous language about whether a loss originating from a third-party product's vulnerability is treated as a first-party breach or a supply chain event. Those two classifications can land in different coverage buckets, sometimes with different sublimits. If your policy has not been reviewed against this specific scenario, now is a reasonable time to do that.

The control that would have blunted it

The control most directly relevant here is privileged access management, or PAM, combined with credential isolation between third-party tools and production systems. The attacker obtained high-level internal credentials through a third-party security product. That means the third-party product had access to credentials that could issue commands to the wallet infrastructure. In a well-configured environment, a security product sitting at the perimeter or monitoring layer would have read access and alert capability, and its service account would have no authority to initiate financial transactions or modify wallet behavior. Separating those permission tiers is the work of least-privilege architecture applied consistently across both first-party and third-party tooling.

In practice, this is harder than it sounds. Third-party security vendors often request broad permissions during onboarding, and engineering teams under delivery pressure grant them without a detailed review of what those permissions enable downstream. I have seen this in every category of vendor: endpoint detection tools, network monitoring platforms, identity providers, and SIEM integrations. The vendor's installation guide says "grant admin" and teams do it because the alternative is a support escalation. The fix is a formal third-party access review process that treats every vendor integration as a potential pivot point, assigns the minimum permissions needed for the stated function, and re-reviews those grants on a defined schedule, typically annually or after any significant product update.

PAM platforms like CyberArk, Delinea, or BeyondTrust can enforce session recording, just-in-time access, and credential vaulting so that third-party tools never hold persistent credentials to sensitive systems. That architecture would not have prevented the initial exploitation of the third-party product's vulnerability, but it would have contained the blast radius by ensuring that the credentials available from that foothold were scoped, time-limited, and auditable. The attacker would have needed to escalate further rather than moving directly to wallet commands.

Cyber insurers increasingly require documented PAM controls as a condition of coverage for financial services and fintech organizations. The specific questions vary by carrier, but the common thread is evidence of least-privilege enforcement, MFA on privileged accounts, and periodic access reviews. If your organization is renewing a policy or seeking a new one, expect underwriters to ask about third-party vendor access specifically, given the frequency of this attack pattern in 2025 and 2026. Having documented controls and a vendor access register ready for that conversation materially affects both coverage terms and premium.

If you are working through what your current security posture would look like to a cyber insurance underwriter, the Strondex Cyber Insurance Readiness assessment maps your existing controls against the access management requirements most carriers are applying today.