Security News | ONEMINERS NEWS DESK
Attackers drained Bitget's hot wallets in one of the largest exchange hacks on record. Customers are covered, but the lesson applies to everyone.
By Michal Beno, CEO, OneMiners
30 September 2026 · 4 min read
What happened
On 24 September 2026, attackers moved about $387.5 million out of crypto exchange Bitget's hot and warm wallets. Cold storage was not touched, and Bitget says its $464 million User Protection Fund covers the loss in full, so customer balances are intact.
The attack began at 18:31 UTC. No private keys were stolen. Instead, the attacker got into a backend wallet system, faked withdrawal requests, and Bitget's own approval process signed the transfers. The stolen funds were a mix of ETH, XRP, BNB, AVAX and stablecoins across seven blockchains. Bitget first put the loss at $351.6 million, then raised it to $387.5 million on 27 September.
$387.5M
stolen from hot and warm wallets
$464M+
Bitget User Protection Fund
7
blockchains hit
5%
recovery bounty offered
Bitget statements as reported by BleepingComputer (28 Sep), Fortune (25 Sep) and The Hacker News.
Who is behind it
Blockchain analysts at Elliptic say the attack is highly likely linked to North Korea. Other reports connect it to the TraderTraitor group, the same crew blamed for the $1.5 billion Bybit hack in 2025. Elliptic says this one pushes suspected North Korean crypto theft past $1 billion in 2026. No government has confirmed it yet.
The stolen coins were split into round lots, swapped across bridges and converted into Bitcoin, and some went through a mixer. Circle and Tether froze only about $330,000 of stablecoins.
Largest crypto exchange hacks on record
US$ millions at the time of the theft
Can Bitget customers withdraw?
Yes, in stages. Bitget paused withdrawals, then reopened them step by step: Bitcoin on 28 September, the main Ethereum networks on 29 September, USDT on 30 September, and all remaining assets, including fiat, on 2 October.
Three simple ways to protect your coins
THE ONEMINERS VIEW
Every major exchange hack is a reminder of the oldest rule in Bitcoin: not your keys, not your coins. Mining is one way to build a Bitcoin position without buying on an exchange at all. With a hosted Bitcoin miner, new coins are produced by your own machine. Learn how it works.
START WITH ONEMINERS
Build your Bitcoin stack from the source.
How hosted mining worksBrowse Bitcoin minersSOURCES AND DATA
- Bitget incident details and withdrawal schedule: BleepingComputer, 28 September 2026
- Loss, protection fund and bounty: Fortune, 25 September 2026; The Hacker News
- Attribution and 2026 total: Elliptic, 25 September 2026; TRM Labs
- Laundering route: TRM Labs; Cryptonomist, 28 September 2026
- Historical hacks: softstack exchange-hack list; Cryptonomist
Michal Beno
CEO of OneMiners, the global Bitcoin mining hosting and hardware platform with 15 published hosting locations, 7-year fixed electricity contracts and a 7-year hardware warranty. He writes about the economics of industrial Bitcoin mining.
Informational only, not financial advice. Figures are a snapshot from public market data and news reports as of 30 September 2026 and can change quickly. Crypto prices can fall as well as rise. No return is offered or implied. Do your own research.
