Bitget CEO Gracy Chen announced during an X livestream on the evening of the September 24 hack that the attack bore the hallmarks of North Korean state-sponsored threat actors. She cited suspicious IP addresses tied to VPN infrastructure previously used by North Korean hacker groups.
Bitget detected abnormal transfers from some hot wallets on Thursday afternoon Eastern time. The hackers exploited a backend wallet system that processes wallet transactions, forging transfer approvals that tricked the system into authorizing the fraudulent transactions. Chen confirmed that cold wallets and private keys remained safe and uncompromised.
The stolen assets include Ether, XRP, USDT, USDC, Avalanche, and BNB across the Ethereum, XRP Ledger, Avalanche, BSC, and Arbitrum networks. Early independent on-chain analysis initially put the total stolen value at $170 million to $183 million, before Bitget announced an initial official value of $351.6 million. Comprehensive audits revised the final official value to $387.5 million.
Bitget temporarily froze user withdrawals, while deposits and trading remained functional. The company announced that its over $464 million User Protection Fund would cover the full loss. It says it has fixed the backend vulnerability and is rolling out a staggered withdrawal schedule starting Monday, September 28, to manage network traffic and ensure complete infrastructure security.
After the attack, the hackers quickly converted USDT, USDC, and tokenized gold (XAUt) into ETH on decentralized exchanges within minutes of the theft to circumvent on-chain blacklisting or freezing of the stablecoins. Native layer-1 assets like XRP, ETH, BNB, and TRX, which cannot be frozen or reversed, were quickly fragmented and distributed across dozens of new attacker-controlled wallets. Bitget launched a recovery-bounty program offering rewards of up to 5% for funds successfully frozen or recovered.
The incident is the latest in a series of hacks in the crypto industry. Earlier this month, attackers drained $320 million in Bitcoin from the Liquid Network, emptying nearly 95% of its federation wallet. In April, crypto platform Drift lost $270 million in a hack. Many hacks have been linked to state actors, with North Korea leading the pack. In February 2025, the FBI identified North Korean hackers as the perpetrators behind the biggest crypto hack in history, stealing over $1.5 billion from Bybit.