Bitget Suffers Record-Breaking Hack Exposing Web3 Security Gaps
The Bitget hack in September 2026 was one of the largest on record, with an estimated $387.5 million stolen.
The attackers targeted Bitget's backend infrastructure to spoof on-chain transactions, exploiting a vulnerability in a third-party security product used by the exchange.
This allowed them to generate fake transactions that were automatically approved without raising alerts, and they then drained hot and warm wallets but left cold ones unaffected.
About $100 million of the stolen tokens were converted to ETH to protect other assets from being frozen or blocklisted, and an additional $85 million was already in ETH. The remaining assets included XRP and TRX.
The hack was attributed to North Korea's Lazarus Group based on a pattern of rapid conversions of some assets, IP addresses used, and transfers to wallets linked to past hacks.