Bitget Resumes Withdrawals After $387.5M Hack
Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals after suspending them following a breach in which suspected North Korean hackers stole more than $350 million, in one of the largest exchange thefts of the year.
Key facts
The loss: Reported at $387.5 million, with over $350 million confirmed stolen
Suspected actor: North Korean hackers, per reporting; not officially confirmed
Timeline: Bitget's security systems caught unauthorized transfers on September 24, 2026
The method: Attackers obtained high-level internal credentials, then used them to send fraudulent withdrawal commands to Bitget's wallet system
Scope: Hot and warm wallet infrastructure across seven blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base
Status: Bitcoin withdrawals have resumed; some wallet addresses linked to the attacker have been frozen
How was the exchange breached?
Through credentials, not cryptography. The attacker obtained high-level internal credentials and on September 24 used them to issue fraudulent withdrawal commands to Bitget's wallet system.
Hot wallets are connected to the internet to process customer withdrawals quickly. Warm wallets sit between hot wallets and fully offline cold storage. Both are reachable by systems an attacker with internal access can command — which is why exchange thefts typically target operational access rather than breaking encryption.
Bitget's security systems detected the unauthorized transfers, and some attacker-linked wallet addresses have since been frozen.
Why is North Korea suspected?
Because of the pattern. North Korean state-linked groups have been tied to a long series of large cryptocurrency exchange thefts, with stolen funds widely reported to fund state programs. Attribution here is reported rather than officially confirmed, and should be treated as provisional.
What does this mean for the industry?
Exchange breaches have consistently come down to operational security — credentials, insiders, internal tooling — rather than flaws in blockchains themselves. That distinction matters for anyone evaluating custody risk: the security question is about how an exchange controls internal access, not how strong its cryptography is.
For individuals holding crypto on an exchange, the practical guidance is unchanged and unexciting: assets on an exchange are in that company's custody, withdrawal freezes during an incident are normal, and the only way to hold assets outside that risk is self-custody, which introduces different risks of its own.
Sources: BleepingComputer; SecurityWeek.