The Largest Crypto Theft of the Year So Far
At 18:31 UTC on September 24, Bitget's own security systems flagged something wrong. Unauthorized transfers were moving funds out of the exchange's hot and warm wallets across seven different blockchains at once: Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base. By the time Bitget froze what it could and paused withdrawals, roughly 351.6 million dollars had already left the building. It is, so far, the largest cryptocurrency theft of 2026.
Nobody Stole a Key
Here is the detail that should worry people who do not own a single satoshi of cryptocurrency. Bitget says its private keys were never stolen. The attackers did not need them. Instead, according to the exchange, someone compromised a backend system and manipulated the transaction data being shown to Bitget's own internal authorization process, feeding its approval system a lie convincing enough that it approved transfers it should have rejected.
That is not really a crypto specific vulnerability. It is a trust boundary failure, the same category of mistake that shows up anywhere a system is designed to trust its own internal data without independently verifying it against something outside that system's control. A payment platform, a payroll system, or an internal approval workflow for wire transfers can all fail the exact same way if the thing doing the approving trusts what it is shown rather than verifying it against a separate, harder to tamper with source of truth.
Who Did It
Bitget CEO Gracy Chen said investigators traced IP addresses used in the attack back to VPN services previously associated with a hacking group linked to North Korea. No government agency has formally attributed the attack to Pyongyang as of this writing, and Bitget is continuing its investigation alongside law enforcement and outside firms including Mandiant and SlowMist. North Korean state linked hacking groups have been responsible for a significant share of the largest cryptocurrency thefts over the past several years, and the tradecraft described here, patient backend access followed by manipulation of an internal system rather than a smash and grab, fits a pattern researchers have documented from these groups before.
What This Means If You Are Not Running a Crypto Exchange
Most businesses reading this do not operate a hot wallet. The lesson still applies. Anywhere your business has an automated system that approves financial transactions, whether that is a payment processor, an accounts payable workflow, or an internal tool that releases funds or approves large transfers, ask exactly what that system is trusting to make its decision, and where that data actually comes from. If the answer is "another part of our own backend," you have exactly the kind of single point of failure Bitget just learned about the hard way.
Bitget says the loss falls within its User Protection Fund and that customers should not be directly affected. That is good news for Bitget's customers and does nothing to change the underlying lesson for everyone else. At AetherGuard Technologies, reviewing exactly these kinds of internal trust assumptions, the systems your business relies on to approve money moving anywhere, is a core part of the security assessments we run for clients handling their own financial operations.
