Bitget detected breach 30 minutes before $290 million in transfers began

September 28, 2026 at 07:30 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Bitget detected unauthorized wallet transfers at 18:31 UTC on Sept. 24, about 30 minutes before attackers began moving $290 million in two major waves. The exchange said it activated emergency protocols immediately, but blockchain security firm Hypernative traced $87.6 million leaving hot wallets at 19:01 and $202.8 million leaving warm wallets at 19:16. The breach ultimately moved $387.5 million to attacker-controlled addresses, according to Bitget.

Key Facts

Bitget detected unauthorized transfers at 18:31 UTC on Sept. 24, 30 minutes before the first major drain of $87.6 million at 19:01.
A second wave of $202.8 million left warm wallets at 19:16, bringing the total loss to $387.5 million.
Bitget restarted Bitcoin withdrawals at 08:00 UTC on Sept. 28 after additional security checks.
The exchange initially estimated the affected amount at $351.6 million before revising it to $387.5 million after identifying additional Zcash and TRON transfers.
Bitget said cold wallets were unaffected and user account balances remained intact.

Attack Timeline

Bitget's systems flagged unauthorized transfers at 18:31 UTC on Sept. 24, and the security team immediately activated emergency protocols. Hypernative's reconstruction shows the attacker first tested the compromised route at 18:31 with transfers of 0.84 ETH and 93 TRX to new addresses. After waiting about 28 minutes, the attacker moved $34.75 million of USDT at 18:58, then $87.6 million left hot wallets at 19:01 and $202.8 million left warm wallets at 19:16. Those two bursts, completed in a combined 24 seconds, accounted for about three-quarters of the $387.5 million Bitget ultimately said was moved to attacker-controlled addresses.

Containment Failure

Bitget said its investigation found the attacker compromised a backend system in its wallet infrastructure, spoofed withdrawal data, and tricked the exchange's authorization process into approving the transfers. The company said private keys were not compromised. Hypernative said the transactions were signed by Bitget's own wallets and resembled ordinary customer withdrawals closely enough to pass through its infrastructure. The security firm identified several controls that could have interrupted the attack after the initial alert, including a check requiring every signed transfer to correspond with an independently stored customer withdrawal or approved treasury transaction. Hypernative also found unusual transaction parameters in the attacker's requests, including gas limits that differed from Bitget's normal withdrawal pipeline.

Withdrawal Resumption

Bitget restarted Bitcoin withdrawals at 08:00 UTC on Sept. 28 after additional security checks. The exchange's Sept. 26 withdrawal update said the vulnerability behind the incident had been identified and remediated, while its investigation with Mandiant and SlowMist continued. Bitget initially estimated the affected amount at $351.6 million before revising the figure to approximately $387.5 million after further transaction classification identified additional affected Zcash and TRON transfers. The exchange said the revision did not represent additional unauthorized transfers after the incident was contained, and that cold wallets were unaffected and user account balances remained intact.