Bitget exploit analysis

On 24 September 2026, attackers stole $387.5 million in crypto assets from Bitget, a centralized exchange founded in Singapore and headquartered in the Seychelles. The loss was first disclosed by Bitget CEO Gracy Chen, who said the company believed a North Korean cybercrime group was responsible. Stablecoin issuers Circle and Tether froze $318,000 of the stolen assets, but the majority of the haul had already been swapped into decentralized cryptocurrencies that issuers cannot freeze. Bitget paused withdrawals shortly after the theft was noticed. The company has since said its reserves are sufficient to cover the loss.

The mechanism has not been publicly disclosed. Bitget's official statement framed the event as an external attack without explaining the entry point. Centralized exchange compromises of this scale in the past few years have generally involved either compromised signing keys held by the exchange, an insider with privileged access, or a compromise of a third-party vendor with API access. Bitget has not narrowed that range in public statements. Chen's North Korean attribution, made in the immediate aftermath, is consistent with the Lazarus Group pattern of large centralised-exchange drains but is not an attribution Bitget or any outside researcher has substantiated.

The figure is Bitget's. The web3isgoinggreat account puts it at $387.5 million, and Bitget's own incident update uses the same number. The $318,000 frozen by Circle and Tether was disclosed by the issuers, and the difference between the two figures is the proportion of the stolen assets that issuers could actually freeze, which is a function of which stolen assets were still in stablecoin at the time the issuers became aware of the theft.

The response has been procedural. Withdrawals were halted, the loss was disclosed publicly, and the exchange subsequently announced a recovery bounty program offering a percentage of recovered funds to anyone returning assets. No customer funds were lost, Bitget has said, because the company's reserves are large enough to absorb the theft. The framing matters: a $388 million loss that the exchange covers from its own reserves is a different event from a $388 million loss that customers absorb. The first is a corporate loss; the second is a depositor loss. Bitget has placed itself firmly in the first.

Compared with the other large centralized-exchange compromises in the corpus, Bitget's $388 million sits at the upper end. The 2025 Coinbase disclosure of $400 million in customer social-engineering losses is one of the few events that exceeded it. The Bitget theft is on the same scale as the Bybit $1.4 billion North Korean attribution in February 2025. The Lazarus Group pattern of stealing from centralized exchanges by compromising signer keys or vendor access appears to have continued through 2026.