0
$0.00
0 items
On September 24, 2026, at 18:31 UTC, North Korea's Lazarus Group began draining Bitget's hot and warm wallets. Cryptocurrency exchange Bitget confirmed that assets equivalent to about $387.5 million were stolen in an attack the company announced on September 24. Before this attack, $1.73 billion had been stolen across 333 incidents targeting crypto groups in 2026, according to TRM Labs. It is now October 3. Bitcoin withdrawals returned from September 28, Ethereum on September 29, USDT on September 30, with other tokens and fiat still in the process of being restored. Customers were locked out of their own funds for the better part of a week.
This is the largest single crypto exchange breach of 2026. It followed the $1.5 billion Bybit hack of February 2025 by just nineteen months. And like Bybit, it happened to an exchange that was doing everything its security team believed was right.
Understanding exactly how this attack worked changes how you think about exchange custody, permanently.
The detail that matters most about the Bitget hack is how the attacker got in. Bitget says they exploited a vulnerability in a third-party security product to obtain high-level internal credentials. They then used those credentials to send fraudulent withdrawal commands to the wallet system.
This is not a stolen private key attack. It is not a phishing attack against a Bitget employee. It is not a smart contract exploit. Bitget CEO Gracy Chen said the attacker "used legitimate credentials" and disguised their activity as routine administrative operations. The entry point was a third-party security product, the very type of software installed to protect the exchange.
According to Bitget's own incident timeline, unauthorised transfers began at 18:31 UTC on September 24. The exchange's reconciliation system flagged a discrepancy at 19:05 UTC and withdrawals were blocked. In 34 minutes, $387.5 million was gone.
About $100 million of the stolen tokens were converted to ETH, largely to protect USDT, USDC, and similar assets from being frozen or blocklisted, and an additional $85 million was already ETH. About $157.5 million in XRP and $7 million in TRX remained unconverted. The pattern of converting assets, including rapid conversions of some assets, IP addresses used, and transfers to wallets linked to past hacks, resulted in this incident being attributed to North Korea's Lazarus Group.
The Bybit hack worked through UI manipulation, attackers convinced Bybit's signers they were approving a routine transaction when they were not. The Bitget hack worked through credential theft from a third-party product, attackers obtained the keys to the kingdom through a vendor, not through Bitget's own systems.
Both attacks share the same lesson: the security of exchange-held assets depends not just on the exchange's own security practices, but on every vendor, contractor, and third-party integration in their entire supply chain. A single vulnerability in any one of them can become the entry point for $387.5 million in losses.
This is not a solvable problem at the exchange level. Modern exchange infrastructure is too complex, too interconnected, and too dependent on third-party tools to eliminate every vendor risk. The Bitget security team did not make an obvious mistake. A product they trusted was compromised. The funds were gone in under 35 minutes.
For customers holding assets on any exchange, however reputable, however well-capitalised, however sophisticated its security team, the supply chain attack is the threat that no amount of trust in the exchange directly can mitigate.
Bitget CEO Gracy Chen said cold wallet reserves were untouched and that the exchange's $464 million User Protection Fund covers the stolen amount, so customer balances should remain intact regardless of the breach.
Bitget's ability to cover the losses is genuinely good news for its customers. The entire sum will be covered by the $464 million Bitget User Protection Fund, and the exchange has offered a 5% bounty for freezing attacker funds and a 5% one for recovery. But the protection fund lesson cuts both ways.
Bybit also covered its losses, $1.5 billion, by drawing on reserves and bridge loans. The existence of a protection fund means customers were not wiped out this time. It does not mean the next exchange that gets hacked will have a fund large enough to cover it. And it does not change the week of frozen withdrawals that Bitget customers experienced regardless of the fund's existence.
The protection fund is an insurance product. Insurance is what you rely on when something goes wrong. Self-custody is what prevents something going wrong in the first place.
The Bitget hack worked because the attackers obtained credentials that gave them authority over Bitget's wallet system. In exchange custody, there is a centralised system with credentials that, if obtained, provide authority over all customer funds simultaneously. In self-custody, that centralised system does not exist.
An attacker drained around $387.5 million from Bitget's hot and warm wallets across seven networks in a single attack because all of those funds were accessible through a single administrative layer. Your private key on a Cypherock X1 is not accessible through any administrative layer. It is distributed across five hardware components, 1 X1 Vault and 4 X1 Cards, using Shamir's Secret Sharing. Any two of the five components reconstruct access. No single component holds the complete key. No credential, however legitimate, on any server anywhere, provides access to your private key, because your private key is not on any server.
The Lazarus Group's attack chain, vendor compromise, credential theft, fraudulent withdrawal commands, terminates at the exchange's wallet system. It has no pathway to a private key distributed across physical hardware you hold in separate locations.
This is not theoretical protection. It is architectural immunity to the specific attack that stole $387.5 million this week.
Bitget's hack is the largest crypto hack this year. Bybit was the largest in 2025. Mt. Gox was the largest of its era. FTX was the largest custodial collapse. Celsius, Voyager, BlockFi, the list of exchange failures goes back to the beginning of crypto's exchange history.
Every cycle, a new exchange occupies the position of "largest hack in crypto history." Every cycle, customers who held assets there lose access to their funds, sometimes permanently, sometimes temporarily, always involuntarily.
The pattern is not a coincidence. It is the predictable result of concentrating large pools of customer assets in centralised systems accessible through credentials that can be stolen. The attack vectors evolve, phishing, then social engineering, then supply chain compromise of third-party tools. The structural vulnerability remains constant: centralisation creates a single high-value target.
Self-custody eliminates that target. Not by making attacks impossible, hardware wallets can be lost, stolen, or misconfigured. But by eliminating the single-point-of-failure structure that makes exchange hacks worth the effort and scale of a Lazarus Group operation. There is no point attacking a distributed hardware wallet architecture with state-level resources because the yield, one person's holdings, requiring physical access to multiple hardware components, does not justify the investment.
Bitget's withdrawals are now restored. The protection fund will cover losses. This particular crisis is over for Bitget customers. The next one is already being planned.
$1.73 billion had been stolen across 333 incidents targeting crypto groups in 2026 before the Bitget hack added another $387.5 million. That is an average of more than one exchange-level incident every day of 2026 so far.
The productive response is not to identify which exchange is safest. It is to move long-term holdings off exchanges entirely, into hardware wallet self-custody, before the next $387.5 million event affects the platform you are using.
Explore Cypherock X1, the distributed hardware wallet that eliminates seed phrase vulnerability and makes exchange hack architecture irrelevant to your holdings. Read how the SSS key distribution works and follow the step-by-step migration guide to move your assets before the next breach.
Related Reading:-
