Nothing tests a crypto exchange's PR team quite like watching $352 million walk out the back door while the CEO insists everything's fine. Bitget's had that exact week.

Spoofed Transfers, Real Money Gone

Bitget detected unauthorized transfers from its hot wallets at 18:31 UTC on September 24, 2026. Within about an hour, roughly $183 million had already moved into a freshly created wallet address, with the total loss climbing past $350 million. CEO Gracy Chen said the attack didn't come from compromised private keys — instead, attackers got into the wallet backend, spoofed transaction data, and tricked the exchange's own authorization process into approving transfers it never should have.

Investigators traced IP addresses linked to VPN services previously tied to a North Korean hacking group. Cold wallets, held offline, were untouched — only the hot wallets used for daily trading were hit. Withdrawals are paused while Bitget rebuilds the affected systems; deposits and trading are still running.

The Line Between Hacked and Ruined

This is now the largest crypto hack of 2026, and it's a case study in why "our private keys are safe" isn't the same as "we weren't breached." Attackers don't need your keys if they can convince your own systems to sign off on a fake transaction — the authorization logic itself was the weak link.

Bitget says the loss is fully covered by its $464 million User Protection Fund, which is the corporate equivalent of having really good insurance after your house burns down. Comforting, but it doesn't undo the fact that the backend trusted something it shouldn't have.

$352 million is a rounding error to nobody — including, apparently, whoever signed off on that transfer authorization.

If "our system approved a request it never should have" is the scariest sentence in tech, that's exactly the kind of gap WTK helps businesses close before it becomes a headline — check out our free security checklist for a place to start.

Source: CoinDesk