Bitget's $351.6M Hot-Wallet Theft Turns on Spoofed Authorization
Suspected North Korean hackers stole approximately $351.6 million from cryptocurrency exchange Bitget, making it the largest known digital currency heist of 2026 to date. The theft was reported on Sept. 25, 2026. TechCrunch
The funds were removed through unauthorized transfers from internet-connected hot wallets used for active trading. Withdrawals were paused. Bitget suspended crypto withdrawals after detecting the breach.
The intrusion did not involve compromised private keys. Bitget said the hack involved spoofed transfers via a compromised wallet backend that spoofed transaction data to trigger authorization. CoinDesk Private keys held. Authorization logic failed.
For operators of exchange infrastructure, that distinction matters. A key compromise implies loss of secret material and forces wholesale rotation and reassessment of key management, HSM boundaries and signing policy. A backend spoof implies the signing stack acted on false display data, which points to UI validation, transaction simulation and out-of-band verification rather than key storage.
Bitget stated it holds $464 million in its user protection fund to cover the costs of the theft. That figure would cover the nominal loss in full, if applied directly. The company has given different fund valuations in prior disclosures. Bitget reported its Protection Fund averaged $580 million in its UEX Security Standard framework, and said the fund reached $716 million in June 2025. It also reported a 163% Proof of Reserves ratio under that framework.
Bitget CEO Gracy Chen said the breach was highly consistent with known patterns of North Korean hacker organizations. Attribution remains suspicion at this stage, not a formal indictment or confirmed finding.
The incident fits a concentrated pattern in 2026. According to TRM Labs, North Korea was behind around three-quarters of all crypto theft value in 2026 to date. A September 2026 heist involving $340 million saw the hacker return all but $47 million of the stolen funds. Earlier in September, the Bitcoin-based Liquid Network reported that $320 million was withdrawn in a hack. Bloomberg
Bitget has previously described high volumes of hostile traffic. Between July 2025 and June 2026, its security infrastructure intercepted more than 150 million malicious requests. Earlier in 2026, Bitget listed Immunefi (IMU) on Launchpool and Spot trading, a reminder that exchange attack surface continues to expand through listings, APIs and backend integrations alongside core custody.
The broader context here is the shift in where exchange risk now concentrates. Hot wallets are deliberately exposed for liquidity, so isolation and limits can contain loss but cannot remove it. When the backend that constructs and presents transactions can be compromised, even correct key handling will sign incorrect transfers. In this author's view, that makes deterministic display, segregated signing intent, and hardware-enforced policy checks more important than adding further perimeter controls.
Looking at what this means for practitioners, the Bitget case argues for treating wallet backends as untrusted input. Independent transaction decoding, allowlist enforcement, velocity limits on hot balances, and multisig quorum with separate codebases and infrastructure reduce the blast radius of a single spoofed view. Full reimbursement from a protection fund restores user balances, but it does not restore confidence in the signing pipeline. Worth flagging: the long-term gain from incidents like this has usually been better defaults, from Proof of Reserves publication to standardized fund disclosures, and this event is likely to accelerate work on verifiable transaction intent.
