Bitget experienced a significant security breach on September 24, 2026, resulting in a loss of approximately $388 million. The attack was attributed to the Lazarus Group, a North Korean hacking entity, according to Bitget's CEO, Gracy Chen.
The attackers exploited a zero-day vulnerability in a third-party security product, allowing them to gain internal credentials. This breach enabled them to steal various cryptocurrencies, including Ethereum (ETH), USDT, USDC, BNB, and XRP, with the largest single loss being about $83 million in XRP.
In response to the hack, Bitget temporarily suspended withdrawals but resumed them on September 28, 29, and October 2 for different cryptocurrencies. The company's protection fund, initially at $464 million, was used to cover the losses and later replenished to $309 million by September 30, 2026.
The hackers utilized a custom withdrawal tool to manipulate transaction information and trigger Bitget's approval process. Investigators managed to freeze only about $821,000 of the stolen funds. A significant portion of the funds was laundered through THORChain, which declined to block the hackers' addresses.