Bitget Support Center security notice (24 September 2026) confirmed unauthorized transfers from portions of its hot and warm wallet layers. Initial figure ~US$351.6 million; later reconciliation ~US$387.5–388 million across multiple chains.

Cold wallets and private keys stated intact; User Protection Fund covers impact. Updated 28 Sep 2026: Bitget's Academy timeline (first published 27 Sep, 6:04 pm Perth) and CEO Gracy Chen's 28 Sep AMA say the attacker exploited a vulnerability in an unnamed third-party security product to obtain high-level internal credentials, then injected fraudulent withdrawal commands; BTC withdrawals resumed 28 Sep 08:00 UTC with phased restore.

Updated 30 Sep 2026: BleepingComputer (7:11 pm Perth), citing SlowMist and Mandiant forensics, reports threat actors compromised two unnamed third-party security appliances ("Product A" and "B") with zero-day exploits; earliest malicious activity in available logs 31 August; hidden scripts under a Product A service process read DB password env vars; on 24 Sep privileged access to appliances A/B, webshell on appliance B, C2, lateral move to Bitget production wallet job server, malicious packages and a custom withdrawal tool; theft window ~02:31–05:23 UTC+8 spanning ETH/XRP/BNB/AVAX/USDT/USDC and multiple chains. North Korean tradecraft still suspected.

Products remain unnamed publicly. Primary: Bitget Support + Academy; forensics wire: BleepingComputer 30 Sep (Mandiant/SlowMist). (source: BleepingComputer)