Bitget Hit for $351.6M as Circle and Tether Freeze Loot

Bitget lost $351.6 million in a backend wallet compromise, and Circle and Tether froze attacker stablecoins without waiting for any legal request.

Bitget detected unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24, 2026, and later confirmed approximately $351.6 million in assets were moved, according to a security notice from CEO Gracy Chen reported by MarketForces Africa. The Seychelles-based exchange immediately suspended customer withdrawals as a precaution, while deposits and trading stayed operational. The attack hit parts of the hot and warm wallet layers, but Bitget says its cold wallets and private keys were untouched, and that customer balances remain accurate.

The surprise is the vector: investigators ruled out private-key theft entirely. Instead, the attacker breached a critical backend wallet system, spoofed transfer information inside it, and tricked Bitget's own authorization-signing process into approving malicious transactions with valid signatures. The American Bazaar reports Chen said the breach has been contained and the intrusion method remains under technical investigation. It is a reminder that an exchange can hold its keys securely and still lose nine figures through the pipeline that feeds its signing systems.

The most surprising twist is how fast issuers acted. BitKE reports that Circle blacklisted a wallet linked to the attacker at 0500 GMT, hours after the breach, containing about 99,990 USDC and 218,023 USDT worth roughly $318,000, with Tether blacklisting the same address afterward. That marks a sharp shift from the April 2026 Drift Protocol hack, when Circle declined to freeze about $230 million in stolen USDC and said it acts only when legally required. The Bitget response suggests issuers are now willing to blacklist attacker addresses directly, without a legal request.

The stolen portfolio spans XRP, Ethereum, stablecoins, BNB, AVAX, TRX and tokenized gold. Bitcoin Foundation details roughly 102.9 million XRP and about 31,890 ETH among the tracked transfers, and notes initial estimates undershot the total because monitoring focused on Ethereum-compatible networks at first. The attackers converted substantial stablecoins and other tokens into native ETH to sidestep issuer-controlled freezing mechanisms, then moved funds across several networks and through exchanges they do not control to blur the trail.

Chen told a livestream on X that investigators identified IP addresses tied to VPN services previously used by a North Korean hacking group, and that the attack pattern resembles earlier operations attributed to the country, The American Bazaar reports; MarketForces Africa also says the exchange suspects North Korean-linked actors. The specific entry method remains under investigation. Bybit CEO Ben Zhou said his team was standing by to assist and is updating its LazarusBounty platform to help trace the funds, returning support Bitget extended after Bybit's own $1.5 billion hack in February 2025, which the FBI attributed to North Korea.

Bitget maintains that all user funds are safe and that the loss is fully covered by its User Protection Fund, which holds more than $464 million, according to MarketForces Africa. Withdrawals remain suspended while teams repair and reinforce affected systems; Chen said restoration could come within hours or days and 'shouldn't take weeks,' per The American Bazaar, though no guaranteed timeline is set. BitKE notes more than 63,000 ETH remains tracked across attacker-controlled addresses and cannot be frozen by issuers, so the recovery race now hinges on exchange cooperation and on-chain forensics.