Bitget hack (September 2026): what happened, how much was lost, and what the records show

On 24 September 2026 Bitget reported a security breach affecting its hot wallets. Early reports put the loss at about $352 million; Bitget later said about $388 million in assets were affected, and the DefiLlama hacks dataset lists $387 million. Bitget said user funds are safe. None of the registers we read shows an active license for Bitget.

What happened

On 24 September 2026 funds were moved out of Bitget's hot wallets to addresses the exchange did not control. Bitget confirmed a security breach the same day and suspended withdrawals, according to Cointelegraph, which reported Bitget as saying that a limited number of hot wallets were affected and cold wallets were not. CoinDesk reported that Bitget said user funds are safe, and The Block reported that Bitget said losses would be covered by its User Protection Fund. These are Bitget's own statements, not findings by a regulator or an auditor.

On 25 September CoinDesk reported that Bitget's chief executive, Gracy Chen, said attackers compromised a wallet backend and spoofed transaction data, and that private keys were not stolen. The DefiLlama hacks dataset classifies the incident as a key compromise. The two descriptions differ, and we record both as they were published.

How much was lost

The amounts differ because reports were written at different times and some count only what had left the wallets while others count all assets Bitget says were affected. Takame's score uses the DefiLlama figure, as our methodology says, and links every other figure to its source.

Where the funds went

• TRM Labs traced the stolen funds across seven blockchains and says the attack was likely carried out by North Korea-linked actors. Cointelegraph reported that Bitget's chief executive said a preliminary investigation found IP addresses matching VPN choices associated with a North Korean hacking group.
• Circle and Tether blacklisted a wallet linked to the hack, freezing about $318,000 in USDC and USDT. Decrypt reported that the attacker had already swapped most of the funds into ether, which cannot be frozen.
• CoinDesk reported on 26 September that the attacker moved about $83 million in XRP, which Ripple cannot freeze.

What official records show about Bitget

• Japan: the Financial Services Agency has named Bitget Limited on its list of operators serving Japanese residents without registration (notices in March 2023 and November 2024).
• Malaysia: Bitget appears on the Securities Commission's investor alert list.
• Canada: a FINTRAC money services business registration for Canada Bitget Limited shows as withdrawn (March 2023). A FINTRAC registration is an anti-money-laundering filing, not a license.
• Earlier incident: the DefiLlama hacks dataset also lists a Bitget entry dated 20 April 2025, about $100 million, classed as market manipulation (market-maker bot exploited).

None of the registers we read shows an active license for Bitget. Bitget may hold registrations in countries whose registers we do not read yet; that does not appear here, and it is not a verdict either way.

Is Bitget safe after the hack?

We do not decide whether an exchange is safe. What you can check yourself before moving money:

1. 1.Whether withdrawals are open again, from Bitget's own status page or announcements, not from social media posts.
2. 2.Which Bitget legal entity serves you in your country, and whether that entity appears on your regulator's register.
3. 3.Whether Bitget publishes a proof of reserves, and what it covers (see our guide to reading proof of reserves).
4. 4.The regulator warnings above, and whether any apply to your country.

On Takame, hacks from the last three years reduce the Incidents part of the score: each loss of $50 million or more removes 10 of its 20 points. With the April 2025 and September 2026 entries, Bitget's Incidents part is at 0 of 20. Registrations, warnings and the incident record for Bitget are on its exchange page, each with a link to the source.