Bitget's $387.5m breach spoofed its approvals, not its keys

The Bitget breach of September 24, 2026 is being logged as a $387.5 million hot-wallet theft, but the more useful number for operations teams is what did not happen: according to TRM Labs' account of the exchange's statements, no private key was stolen. The attacker is reported to have compromised a backend system, spoofed the transaction data shown to Bitget's approval process, and let the exchange's own withdrawal controls sign the transfers. Set against the User Protection Fund that Bitget says "currently holds over $464 million", the revised loss equals roughly 84% of the stated backstop in a single evening.

What Bitget has confirmed

In its first security notice, Bitget said its systems detected unauthorised transfers at 18:31 UTC on September 24, put the loss at approximately $351.6 million, and said cold wallets "remain fully secure". The exchange runs a three-tier wallet architecture, and the breach touched "a portion of the hot wallet and warm wallet layers". Withdrawals were suspended; deposits and trading stayed open.

A September 25 update raised the figure to approximately $387.5 million after on-chain tracing added affected assets on Zcash (ZEC) and TRON that the first estimate missed. The confirmed assets are XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX, spread across Ethereum and several EVM networks, the XRP Ledger, Zcash and TRON. Mandiant and SlowMist are supporting the investigation, and Bitget says its team has identified the attack path, "including details of how the attacker bypassed existing security controls". A Recovery Bounty Program pays 5% of funds successfully frozen and 5% of funds successfully recovered to eligible contributors.

Related:Bullish and Equiniti bet tokenised stocks on the share register

Approvals, not keys

The mechanism comes from TRM Labs' analysis, which reports Bitget CEO Gracy Chen as saying an attacker reached a backend system connected to the wallet infrastructure, spoofed transaction data and triggered the approval process. Bitget's own notices have not published that wording, so it should be read as TRM's account of her statements rather than a confirmed root-cause report.

If that account holds, the control failure sits upstream of the key. Multi-party computation (MPC) schemes and hardware security modules (HSMs) protect how a signature is produced; they do nothing about whether the payload being signed is what the approver thinks it is. A venue can spend heavily on key custody and still lose funds through its own authorised withdrawal path if the approval layer trusts a compromised backend. TRM draws the same line to the February 2025 Bybit theft, where signers approved a manipulated cold-wallet transfer. Neither case relied on stolen keys.

TRM calls this the largest crypto theft of 2026 by value so far and says about $158 million left through the XRP Ledger, with around $7 million in TRX, bringing observed outflows close to Bitget's first figure. Proceeds were split into fresh wallets holding round lots of roughly 10,000 ETH or 20 million XRP, with some routed through THORChain towards Bitcoin (BTC).

Attribution is an assessment, not a finding

Chen has described North Korean involvement as "very likely", according to TRM, citing IP addresses linked to VPN services associated with a North Korean hacking group. TRM says on-chain overlaps with laundering wallets used after the Bybit and AFX Bridge thefts point towards TraderTraitor, but states that it has not definitively attributed the attack and that another actor remains technically possible.

What operations desks should take from it

Bitget's September 26 notice says "The vulnerability involved in the incident has been identified and remediated" and schedules phased withdrawal resumption: BTC from 08:00 UTC on September 28, ETH and the main EVM Layer 2 (L2) networks on September 29, USDT on September 30, and other tokens, fiat and P2P on October 2. How much of the protection fund will actually be drawn is not public; frozen and recovered assets could reduce it.

For brokers, prop firms and exchanges running automated hot-wallet withdrawals, the takeaway is concrete. Key protection answers the question of who can sign. The Bitget incident, as TRM describes it, turned on what the signer was shown. The gaps worth auditing are display integrity between the transaction builder and the approver, independent transaction simulation that decodes the actual payload before signing, and per-window velocity caps enforced outside the backend that builds the request. The same questions sit behind Deutsche Bank's BaFin custody licence, Bastion's OCC trust charter and Crypto.com's Nadex Form 1-N filing. A protection fund absorbed this one. A venue whose backstop is smaller than its hot-wallet float has no such cushion.

This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.