{"id":"bitget-hot-wallet-theft-sep-2026","category":"breach","status":"closed","title":"Bitget restores withdrawals after US$387.5 million crypto theft; recovery continues","tldr":"Attackers stole US$387.5 million from Bitget’s exchange wallets, later reported as about US$388 million. Withdrawals fully resumed on 2 October. Bitget says customer balances were unaffected. Use official channels and beware recovery scams.","summary":"Attackers stole cryptocurrency from Bitget’s custodial exchange wallets on 24 September, prompting a withdrawal suspension while deposits and trading continued. Bitget revised the loss to US$387.5 million the next day; its later account gives approximately US$388 million. The company says attackers exploited a flaw in a third-party security product to obtain internal credentials and authorise fraudulent transfers. Its investigation ruled out stolen private keys. Bitget says cold wallets and its separate self-custodial Bitget Wallet product were unaffected. It reported fixing the vulnerability and said customer balances were unchanged, with the financial impact covered by its Protection Fund. Withdrawals reopened in stages and were fully restored on 2 October. As of its 20 October update, the incident remained contained and asset recovery continued. Some stolen assets had been frozen, but Bitget had not published a cumulative frozen or recovered total.","action":"Nothing for you to patch: Bitget says it repaired its systems and restored withdrawals. Check service information through Bitget’s official app or website, and be wary of impersonators and unofficial recovery services.","product":"Bitget cryptocurrency exchange","audience":"home","severity":"critical","patch":"na","exploited":true,"cves":[],"tags":["bitget","crypto","crypto-theft","exchange","hot-wallet"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Bitget Security Latest Incident Update: Fund Tracing and Recovery Bounty Program","url":"https://www.bitget.com/support/articles/12560603896108","by":"Bitget","date":"2026-09-25"},{"kind":"advisory","title":"Bitget to Resume Withdrawals in Phases","url":"https://www.bitget.com/support/articles/12560603896110","by":"Bitget","date":"2026-09-26"},{"kind":"advisory","title":"Update On Slowmist and Mandiant Report","url":"https://www.bitget.com/support/articles/12560603896305","by":"Bitget","date":"2026-09-30"},{"kind":"advisory","title":"Bitget announcement on completing the phased resumption of token withdrawals, fiat, and C2C services","url":"https://www.bitget.com/support/articles/12560603896369","by":"Bitget","date":"2026-10-02"},{"kind":"post","title":"Bitget Hack Explained: Timeline, Impact and Security Response","url":"https://www.bitget.com/asia/academy/bitget-security-incident-what-happened-timeline-impact-response","by":"Bitget","date":"2026-10-20"},{"kind":"news","title":"Bitget confirms $387.5 million security breach affecting exchange hot wallets","url":"https://www.theblock.co/news/markets/2026-09-24-more-than-170-million-in-crypto-moves-from-bitget-wallets-unidentified-address-416345","by":"The Block","date":"2026-09-24"},{"kind":"news","title":"Bitget starts phased withdrawal resumption following $388 million exploit","url":"https://www.theblock.co/news/business/2026-09-28-bitget-starts-phased-withdrawal-resumption-416965","by":"The Block","date":"2026-09-28"},{"kind":"news","title":"Crypto exchange Bitget says $352 million affected in a hack, claims user funds are 'safe'","url":"https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe","by":"CoinDesk","date":"2026-09-24"}],"started":"2026-09-24","closed":"2026-10-20","created":"2026-11-03T20:25:55.762Z","updated":"2026-11-03T20:25:55.762Z","cve_notes":[],"timeline":[{"at":"2026-10-20","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Bitget’s updated account put the final affected amount at approximately US$388 million and reported no further unauthorised transfers after containment. Recovery continued; some assets were frozen, but a cumulative frozen or recovered total had not been published.","url":"https://www.bitget.com/asia/academy/bitget-security-incident-what-happened-timeline-impact-response","by":"Bitget","patch":null},{"at":"2026-10-02T08:00Z","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Bitget confirmed completion of withdrawal restoration, including remaining tokens, fiat and customer-to-customer services.","url":"https://www.bitget.com/support/articles/12560603896369","by":"Bitget","patch":null},{"at":"2026-09-30T09:00Z","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Bitget said its Protection Fund had been replenished to more than US$300 million.","url":"https://www.bitget.com/asia/academy/bitget-security-incident-what-happened-timeline-impact-response","by":"Bitget","patch":null},{"at":"2026-09-30","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Bitget announced that Mandiant and SlowMist investigation reports were available, both identifying compromised third-party security products as enabling access to the exchange’s wallet environment.","url":"https://www.bitget.com/support/articles/12560603896305","by":"Bitget","patch":null},{"at":"2026-09-28T08:00Z","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Bitcoin withdrawals began reopening. Bitget said attackers had exploited a third-party security product to obtain internal credentials; private keys had not been compromised.","url":"https://www.theblock.co/news/business/2026-09-28-bitget-starts-phased-withdrawal-resumption-416965","by":"The Block","patch":null},{"at":"2026-09-26","added":"2026-11-03T20:12:05.486Z","kind":"other","text":"Bitget announced staged withdrawal restoration from 28 September to 2 October. It said customer balances were unaffected and its Protection Fund covered the financial impact.","url":"https://www.bitget.com/support/articles/12560603896110","by":"Bitget","patch":null},{"at":"2026-09-25","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Bitget raised the stolen total from US$351.6 million to US$387.5 million after including Zcash and Tron transfers from the original incident. It said the vulnerability had been remediated, some assets had been frozen and a 5% recovery bounty programme had begun.","url":"https://www.bitget.com/support/articles/12560603896108","by":"Bitget","patch":null},{"at":"2026-09-24","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Bitget’s updated timeline places the first unauthorised transfers at 18:31 UTC and detection at 19:05 UTC, when its systems blocked withdrawals. The theft affected part of its hot and warm wallet infrastructure.","url":"https://www.bitget.com/asia/academy/bitget-security-incident-what-happened-timeline-impact-response","by":"Bitget","patch":"na"}],"url":"https://hard.fyi/live/bitget-hot-wallet-theft-sep-2026/","json":"https://hard.fyi/api/live?id=bitget-hot-wallet-theft-sep-2026"}