Keys Held, Approvals Broken: What Bitget's $388 Million Loss Reveals About the Layer Before the Signature

What Happened

At 18:31 UTC on September 24, 2026 (03:31 JST on September 25), security systems at Bitget, a Seychelles-registered exchange with 120 million registered users, detected unauthorized transfers from its hot wallets. The company initially reported losses of $351.6 million (about JPY 55.1 billion), then on September 25 added outflows on Zcash (ZEC) and TRON (TRX), revising the total upward to approximately $387.5 million. Bitget stated that the roughly $35.9 million increase reflected gaps in its initial accounting rather than any new theft. Ten assets were affected, namely XRP, ETH, USDT, USDC, USDT0, XAUt, BNB, AVAX, ZEC and TRX, and they were consolidated into primary attacker addresses across four environments: EVM chains, the XRP Ledger, Zcash and TRON.

Keys Intact, Funds Gone

According to CEO Gracy Chen, the attacker compromised a core backend system within the wallet infrastructure, spoofed transaction data, and then triggered the company's internal authorization process. No private keys were leaked. Of Bitget's three-tier wallet architecture, cold wallets were untouched and the damage was confined to portions of the hot and warm layers. The critical lesson is that even flawless key management cannot prevent loss if the layer that determines what gets signed or approved is subverted; funds then leave through entirely legitimate procedures. The February 2025 Bybit incident (about $1.5 billion) followed a strikingly similar pattern, in which the transaction content shown to approvers had been manipulated.

The Denomination Risk Inside the Compensation Reserve

Bitget pledged to cover the loss in full from its User Protection Fund, which holds 5,500 BTC valued at roughly $464 million (about JPY 72.7 billion). The loss equals about 83.5% of the fund's value. The fund is denominated in BTC, while the losses span multiple assets including XRP and stablecoins. By simple arithmetic, if BTC falls below roughly $70,450, the fund's value would no longer cover the loss. The certainty of reimbursement therefore depends on the BTC price, a point executives should not overlook.

The Attacker Profile and the Reality of Recovery

Chen said the attacker's IP addresses matched VPN services previously used by a North Korean hacking group. Blockchain analytics firm Elliptic likewise assessed North Korean involvement as highly likely, and said the incident pushed suspected North Korean crypto thefts in 2026 above $1 billion. Mandiant and SlowMist are supporting the investigation and a recovery bounty program has been launched, yet Circle and Tether have been able to freeze only about $318,000. Immediately after the breach, the attacker rapidly swapped around $183 million into ETH, paying roughly 5% above market prices to do so, a clear sign of a playbook that disposes of freezable assets first.

Withdrawal Restoration and Implications for Japan

Withdrawals are being restored chain by chain: BTC on September 28, ETH on September 29, USDT on September 30, and all remaining assets, fiat and P2P on October 2. Notably, Bitget announced in August 2026 that it would end services for Japanese residents, so the direct impact on domestic users is likely limited. Japanese exchanges are already required to segregate customer assets, keep them in cold storage, and hold reserves matching hot-wallet balances. This case shows that, beyond those requirements, the authenticity of the transaction data fed into approval processes should itself become a subject of supervision and internal audit.

[Business Development Insights]

1. Security investment will shift from protecting keys to verifying approval intent. Mechanisms that independently reconstruct and check transaction content through a path separate from the backend before signing, such as independent simulation, policy engines and multi-path verification, are likely to become standard requirements in custody designs for Japanese financial institutions handling tokenized deposits and stablecoins, creating a clear opportunity for infrastructure and compliance providers.
2. Compensation reserves will be judged not only on size but on alignment with liabilities. A protection fund held in a single asset can see its coverage erode with market moves. Reserve designs matched to liability composition, combined with continuous disclosure of fund value against potential exposure (Proof of Coverage), could become a new product category that turns trust into a competitive differentiator.
3. Incident response is moving from single-firm crisis management to shared industry infrastructure. Sharing attacker addresses, issuer-level freezes and chain-by-chain withdrawal restoration all depend on cross-industry cooperation, and the fact that only about $318,000 was frozen exposes the limits of that model. As yen-denominated stablecoins move toward issuance in Japan, real-time information sharing among issuers, exchanges and analytics firms, together with clear operating rules for freeze authority, will become a precondition for market entry.

[Sources]

CoinPost, "Bitget partially explains outflow; loss estimate revised upward" (Sept 26, 2026) https://coinpost.jp/?p=739393

CoinPost, "Bitget to cover losses with 5,500 BTC protection fund; North Korean group suspected" (Sept 25, 2026) https://coinpost.jp/?p=739298

CoinPost, "Unauthorized outflow from Bitget, losses worth $350M" (Sept 25, 2026) https://coinpost.jp/?p=739148

CoinPost, "Bitget ends services for Japan, restrictions to be phased in" (Aug 3, 2026) https://coinpost.jp/?p=729332

Bitget official X (withdrawal resumption schedule) https://x.com/bitget/status/2103695497458557342

CoinDesk, "Bitget's $352 million hack happened via spoofed transfers, not private keys" https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says

Bloomberg, "Crypto Theft by North Korea Tops $1 Billion in 2026 After Bitget Attack" https://www.bloomberg.com/news/articles/2026-09-25/bitget-hack-pushes-north-korean-crypto-haul-past-1-billion

CNBC, "Crypto platform Bitget suspects North Korea is responsible for $352 million hack" https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html

Fortune, "North Korea accused of plundering Bitget for $387 million" https://fortune.com/2026/09/25/north-korea-bitget-387-million-crypto-attack/

Gizmodo, "North Korea 'Very Likely' Behind $388 Million Hack of Crypto Exchange Bitget" https://gizmodo.com/north-korea-very-likely-behind-388-million-hack-of-crypto-exchange-bitget-2000817421

Insurance Journal (Bloomberg), "Crypto Exchange Bitget Says Hackers Stole $352 Million" https://www.insurancejournal.com/news/international/2026/09/25/886838.htm

Yahoo Finance (Decrypt), "Bitget Hacked as $350 Million Vanishes From Crypto Exchange Wallets" https://finance.yahoo.com/markets/crypto/articles/bitget-potentially-hacked-183-million-211538556.html

Bitquery, "Bitget hack: how $352M left, and where it is now" https://bitquery.io/investigations/bitget-hack

The Crypto Times, "Bitget Withdrawals Resume September 28: Full Schedule After $387.5M Hack" https://www.cryptotimes.io/2026/09/26/bitget-withdrawals-resume-september-28-full-schedule-after-387-5m-hack/

CoinCentral, "Bitget Hack Total Jumps To $388 Million As New Details Emerge" https://coincentral.com/bitget-hack-total-jumps-to-388-million-as-new-details-emerge