Bitget raises hack loss estimate to $387.5 million after Slowmist traces August zero-day
Bitget says attackers drained $387.5 million from its hot and warm wallets on September 24, and Slowmist traced the intrusion to a zero-day exploited on August 31.
Why it matters
CertiK puts third-quarter 2026 crypto security losses at $1.26 billion across 247 incidents, up 53.9% from $819.4 million in Q2, and counts the Bitget theft at roughly 31% of the quarter; CryptoSlate reported the breach pushed September losses above April's, making September the costliest month for hacks in 2026 so far. Bitget says customer balances remain accurate and that its User Protection Fund, holding more than $464 million, covers the whole loss.
Where the sources disagree
Total size of the Bitget theft
$178 million, per Arkham's Emmett Gallic
CoinDesk
about $183 million, early on-chain tally
Unchained, CoinDesk, Decrypt
$351.6 million, Bitget's first estimate
CoinDesk, CryptoSlate, CoinGape, Bitcoin Magazine, Crypto.News, Finbold, Bitcoin.com News
$387.5 million, Bitget's revised estimate
Decrypt, Bitcoin Magazine, Bitcoin.com News, Cointelegraph
about $356.86 million, Finbold's asset-level on-chain tally
Finbold
The published figure changed several times over two days as more transfers were identified, and one outlet's asset-level tally sits outside Bitget's revised number.
Whether a cold wallet was involved
one cold wallet among the wallets drained
CoinDesk
cold wallets fully secure and unaffected
CoinDesk, CryptoSlate, Bitcoin Magazine, Crypto.News, Bitcoin.com News
Arkham's analyst said the transactions involved three Bitget hot wallets and one cold wallet, while Bitget's CEO said cold wallets remained fully secure.
Whether the attacker holds bitcoin
no bitcoin among the stolen assets, per Bitget
Bitcoin Magazine
over $28.8 million in bitcoin held by the attacker, per a stolen funds tracker
Bitcoin Magazine
Bitget's security update said the stolen assets were mainly ethereum, tron and USDT and contained no bitcoin, but a stolen-funds tracker showed the attacker holding more than $28.8 million in bitcoin.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (bitget exchange hack)
$180 Million
Unchained
$352 million
CoinDesk
Unchained reports $180 Million, CoinDesk reports $352 million (49% apart).
amount taken (bitget wallets)
$180 Million
Unchained
$351.6 million
CryptoSlate
Unchained reports $180 Million, CryptoSlate reports $351.6 million (49% apart).
amount taken (bitget)
$180 Million
Unchained
$351.6 million
CoinGape
Unchained reports $180 Million, CoinGape reports $351.6 million (49% apart).
amount taken (bitget exchange hack)
$180 Million
Unchained
$351.6 million
Bitcoin Magazine
Unchained reports $180 Million, Bitcoin Magazine reports $351.6 million (49% apart).
amount taken (bitget hack)
$180 Million
Unchained
$351.6 million
Crypto.News
Unchained reports $180 Million, Crypto.News reports $351.6 million (49% apart).
amount taken
$180 Million
Unchained
$351.6 million
Finbold
Unchained reports $180 Million, Finbold reports $351.6 million (49% apart).
amount taken (bitget hack)
$180 Million
Unchained
$351.6 million
Bitcoin.com News
Unchained reports $180 Million, Bitcoin.com News reports $351.6 million (49% apart).
amount taken (bitget)
$180 Million
Unchained
$387.5 million
Decrypt
Unchained reports $180 Million, Decrypt reports $387.5 million (54% apart).
amount taken
$352 million
CoinDesk
$320 million
Bitcoin Magazine
CoinDesk reports $352 million, Bitcoin Magazine reports $320 million (9% apart).
amount taken
$352 million
CoinDesk
$157.48 million
Crypto.News
CoinDesk reports $352 million, Crypto.News reports $157.48 million (55% apart).
amount taken (bitget)
$352 million
CoinDesk
$387.5 million
Decrypt
CoinDesk reports $352 million, Decrypt reports $387.5 million (9% apart).
amount taken (bitget)
$178
CoinDesk
$351
CoinGape
CoinDesk reports $178, CoinGape reports $351 (49% apart).
amount taken (bitget)
$178
CoinDesk
$351.6
Crypto.News
CoinDesk reports $178, Crypto.News reports $351.6 (49% apart).
amount taken (bitget)
$178
CoinDesk
$351
Bitcoin.com News
CoinDesk reports $178, Bitcoin.com News reports $351 (49% apart).
amount taken (bitget)
$178
CoinDesk
$387
Decrypt
CoinDesk reports $178, Decrypt reports $387 (54% apart).
amount taken (bitget)
$178
CoinDesk
$388
Bitcoin Magazine
CoinDesk reports $178, Bitcoin Magazine reports $388 (54% apart).
amount taken
$351.6 million
CryptoSlate
$320 million
Bitcoin Magazine
CryptoSlate reports $351.6 million, Bitcoin Magazine reports $320 million (9% apart).
amount taken
$351.6 million
CryptoSlate
$157.48 million
Crypto.News
CryptoSlate reports $351.6 million, Crypto.News reports $157.48 million (55% apart).
amount taken (bitget)
$351.6 million
CryptoSlate
$387.5 million
Decrypt
CryptoSlate reports $351.6 million, Decrypt reports $387.5 million (9% apart).
amount taken (bitget)
$351
CoinGape
$387
Decrypt
CoinGape reports $351, Decrypt reports $387 (9% apart).
amount taken (bitget exchange)
$351
CoinGape
$388
Bitcoin Magazine
CoinGape reports $351, Bitcoin Magazine reports $388 (10% apart).
amount taken
$351.6 million
CoinGape
$157.48 million
Crypto.News
CoinGape reports $351.6 million, Crypto.News reports $157.48 million (55% apart).
amount taken
$351.6 million
Bitcoin Magazine
$157.48 million
Crypto.News
Bitcoin Magazine reports $351.6 million, Crypto.News reports $157.48 million (55% apart).
amount taken
$320 million
Bitcoin Magazine
$351.6 million
Finbold
Bitcoin Magazine reports $320 million, Finbold reports $351.6 million (9% apart).
amount taken (bitget hack)
$351.6
Crypto.News
$387
Decrypt
Crypto.News reports $351.6, Decrypt reports $387 (9% apart).
amount taken (bitget)
$351.6
Crypto.News
$388
Bitcoin Magazine
Crypto.News reports $351.6, Bitcoin Magazine reports $388 (9% apart).
amount taken
$157.48 million
Crypto.News
$351.6 million
Finbold
Crypto.News reports $157.48 million, Finbold reports $351.6 million (55% apart).
amount taken
$157.48 million
Crypto.News
$351.6 million
Bitcoin.com News
Crypto.News reports $157.48 million, Bitcoin.com News reports $351.6 million (55% apart).
reported value
$464 million
Crypto.News
$157 million
Decrypt
Crypto.News reports $464 million, Decrypt reports $157 million (66% apart).
amount taken (breach september)
$351.6 million
Finbold
$387.5 million
Decrypt
Finbold reports $351.6 million, Decrypt reports $387.5 million (9% apart).
amount taken (bitget hack)
$351
Bitcoin.com News
$387
Decrypt
Bitcoin.com News reports $351, Decrypt reports $387 (9% apart).
amount taken (bitget)
$351
Bitcoin.com News
$388
Bitcoin Magazine
Bitcoin.com News reports $351, Bitcoin Magazine reports $388 (10% apart).
amount taken
$351.6 million
CoinGape
$320 million
Bitcoin Magazine
CoinGape reports $351.6 million, Bitcoin Magazine reports $320 million (9% apart).
amount taken (bitget breach confirmed)
$351.6 million
CoinGape
$387.5 million
Decrypt
CoinGape reports $351.6 million, Decrypt reports $387.5 million (9% apart).
amount taken (bitget)
$351.6 million
Bitcoin Magazine
$387.5 million
Decrypt
Bitcoin Magazine reports $351.6 million, Decrypt reports $387.5 million (9% apart).
amount taken
$320 million
Bitcoin Magazine
$351.6 million
Bitcoin.com News
Bitcoin Magazine reports $320 million, Bitcoin.com News reports $351.6 million (9% apart).
amount taken (bitget breach)
$351.6 million
Crypto.News
$387.5 million
Decrypt
Crypto.News reports $351.6 million, Decrypt reports $387.5 million (9% apart).
amount taken (bitget breach)
$351.6 million
Bitcoin.com News
$387.5 million
Decrypt
Bitcoin.com News reports $351.6 million, Decrypt reports $387.5 million (9% apart).
Key facts
Bitget's security systems detected unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24, 2026.
Reported by CoinDesk
On-chain researchers tallied about $183 million moving out of wallets labelled as Bitget's before the exchange spoke publicly, and Arkham's Emmett Gallic put the figure at $178 million.
183,000,000 USDDisputed figureReported by Unchained
Bitget CEO Gracy Chen said approximately $351.6 million in assets were affected by unauthorized transfers from hot and warm wallets.
351,600,000 USDDisputed figureReported by CoinDesk
Bitget updated its loss tally to $387.5 million, which Chen said reflects a more complete accounting of transfers during the incident.
387,500,000 USDDisputed figureReported by Decrypt
Bitget says its User Protection Fund holds more than $464 million and covers the full loss.
464,000,000 USDDisputed figureReported by CoinDesk
Chen says attackers did not obtain private keys and did not forge user withdrawal requests, and Cointelegraph reports the exchange concluded attackers exploited a vulnerability in a third-party security product to obtain internal credentials and forge withdrawal commands.
Reported by Decrypt
A Slowmist investigation released September 30 traced the earliest malicious activity to August 31, 25 days before the theft, through a zero-day in a service on one node of a third-party security product the firm calls Product A.
Reported by Bitcoin.com News
XRP was the largest stolen asset at 102.93 million tokens worth $157.48 million.
157,480,000 USDDisputed figureReported by Crypto.News
What happened
Bitget detected unauthorized transfers out of some of its hot wallets at 18:31 UTC on September 24, 2026, and CEO Gracy Chen put the loss at $351.6 million, later raising it to $387.5 million. On-chain researchers saw roughly $183 million leave wallets labelled as Bitget's within hours of the detection, and Arkham's Emmett Gallic said three hot wallets and one cold wallet were drained, which contradicts Bitget's claim that its cold wallets were untouched. Bitget says no private keys were taken and that attackers broke into a backend system, spoofing transaction data so the transfers looked legitimate; Slowmist traced the first malicious activity to August 31, when an attacker exploited a zero-day in a third-party security product that Bitcoin.com News refers to as Product A, read a database password out of an environment variable and connected to the database. Chen said IP behaviour patterns and on-chain analysis are highly consistent with known patterns of North Korean hacker organizations, but Bitget has not confirmed who was responsible. Withdrawals remain suspended while deposits and trading continue, XRP is the largest single asset taken at about $157.48 million, and the attacker's current holdings and the exact loss total are both still moving.
How the story developed
- Update
Slowmist dates the intrusion to a zero-day exploited on August 31
The firm's report, current as of September 29, says a hidden script on a Product A node read a database password from an environment variable, with the same activity seen on two more nodes on September 23 and September 25.
- First report
First report by Unchained
Bitget’s Hot and Cold Wallets Hit in Suspected Hack Worth More Than $180 Million
- Update
Unchained reports more than $180 million moving out of Bitget wallets
A newly created address pulled assets from wallets labelled as Bitget's between 2:31 p.m. and 4:55 p.m. ET; Etherscan later tagged it as Bitget Exploiter 1.
- Independent corroboration
Independently corroborated by CoinDesk
Crypto exchange Bitget loses $352 million in hack, claims user funds are 'safe'
- Official statement
Bitget confirms a $351.6 million loss and pauses withdrawals
Gracy Chen said cold wallets and user funds were safe, deposits and trading stayed online, and the User Protection Fund covers the loss.
- Official statement
Official statement from Bitcoin.com News
Everything We Know About Bitget’s Massive $351M Hack
- Update
Chen raises the tally to $387.5 million and points at North Korea
Bitget said the higher figure reflects a more complete accounting, and Chen said IP behaviour patterns and on-chain analysis are highly consistent with known patterns of North Korean hacker organizations. Attribution is not confirmed.
- Update
Slowmist publishes its investigation into the Bitget breach
Bitget brought the firm in on September 25; its report traces25 days of prior access through an employee identity and a custom withdrawal tool that moved funds for 2 hours and 52 minutes, with suspected North Korean scripts found on September 30 routing proceeds through CoW Protocol and Chainflip.
- Update
CertiK puts Q3 losses at $1.26 billion
Q3 losses rose 53.9% from $819.4 million in Q2 across 247 incidents; September losses came to about $769 million across 99 incidents, with $273 million frozen or returned.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 24 Sept 2026, 21:23 UTC: Unchained — 1 independent source, 1 reports
- 24 Sept 2026, 21:59 UTC: CoinDesk — 2 independent sources, 2 reports
- 24 Sept 2026, 22:10 UTC: CryptoSlate — 3 independent sources, 3 reports
- 24 Sept 2026, 22:48 UTC: Crypto News (CryptoNews.net) — 4 independent sources, 4 reports
- 24 Sept 2026, 22:49 UTC: CoinGape — 5 independent sources, 5 reports
- 24 Sept 2026, 22:53 UTC: Bitcoin Magazine — 6 independent sources, 7 reports
- 25 Sept 2026, 04:33 UTC: Crypto.News — 7 independent sources, 9 reports
- 25 Sept 2026, 04:44 UTC: CryptoPotato — 8 independent sources, 10 reports
- 25 Sept 2026, 06:52 UTC: TheNewsCrypto — 9 independent sources, 11 reports
- 25 Sept 2026, 07:15 UTC: The Daily Hodl — 10 independent sources, 12 reports
- 25 Sept 2026, 09:15 UTC: Finbold — 11 independent sources, 14 reports
- 25 Sept 2026, 09:30 UTC: Crypto News Flash — 12 independent sources, 15 reports
- 25 Sept 2026, 13:19 UTC: Protos — 13 independent sources, 16 reports
- 25 Sept 2026, 13:30 UTC: Bitcoin.com News, official — 14 independent sources, 17 reports
- 25 Sept 2026, 17:08 UTC: Decrypt — 15 independent sources, 19 reports
- 28 Sept 2026, 13:16 UTC: U.Today — 16 independent sources, 27 reports
- 1 Oct 2026, 13:35 UTC: Cointelegraph — 17 independent sources, 31 reports
Affected entities
Also mentioned: Avalanche, BNB, Circle, TRON, Arbitrum, Bybit, Liquid Network
Original sources
Related events
Tether loses nearly $5 billion across crypto exchanges as USDC and RLUSD rivals pay to win liquidity
Aave DAO Weighs $50 Million Stablecoin Funding for Custodian-Backed Bitcoin and Ether Loans
Aave DAO is considering a $50 million funding authorization to support institutional lending against Bitcoin and Ether held in regulated custody, while separate proposals advance for native Bitcoin collateral on Aave V4.
Lowest Fee Bitcoin ATMs launches 400-plus US crypto ATMs charging a flat 5% fee
Las Vegas startup Lowest Fee Bitcoin ATMs opened more than 400 US cash-to-crypto ATMs selling Bitcoin, Ethereum, USDT and USDC at a stated flat 5% fee.
NEAR Intents Blocked $50M of Bitget Theft, Then Lost $3.8M to Omni Bug
NEAR Intents blocked over $50 million in Bitget-hack transfers, then two days later lost about $3.8 million to a bug in its Omni deposit layer.
Bybit's 40th proof-of-reserves puts covered assets at $19.6B, USDT user holdings down 11.46%
Bybit's 40th proof-of-reserves report shows $19.6B of covered assets, up from $18.1B, with Bitcoin reserve coverage at 104% and USDT user balances down 11.46% to $3.59B.
Ledger Launches Self-Custodial Bitcoin-Backed Loans via Morpho Protocol
Ledger introduced Crypto Loan, a self-custodial feature allowing users to pledge wrapped Bitcoin as collateral to borrow USDC or USDT stablecoins directly in Ledger Wallet.