Where stolen crypto goes: the $388M Bitget hack, step by step

The alarm at Bitget rang at 19:05 UTC on 24 September 2026. The money kept leaving for another two hours and 18 minutes.

What happened on 24 September?

Two tiny test transfers left Bitget's Ethereum and TRON hot wallets at 18:31 UTC. They stayed below the risk-control threshold, so nothing fired (REPORTED: BlockSec, from a Bitget livestream). The large transfers began at 18:58. At 19:05 Bitget's reconciliation system spotted a gap and blocked user withdrawals. That did not stop the attacker, whose orders were written straight into the wallet system. The last transfer went out at 21:23, and Bitget shut down its signing services at 21:44 (REPORTED: BlockSec, Certora).

Bitget's first estimate was $351.6 million. On 25 September it raised the figure to about $387.5 million after adding Zcash and TRON assets it had missed. Here is its own post from that day:

Show moreShow less

Posted by @bitget on 25 September 2026. We opened it on 15 October and it is public and matches the figure above.

CONFIRMED (Bitget's incident page, last updated 13 October 2026): the loss is about $387 million, taken from 12 wallet addresses, all hot or warm wallets. Cold wallets and private keys were not touched, Bitget says.

How did they get in?

Bitget says the attackers used a zero-day, a flaw nobody knew about, in a third-party security product. That gave them high-privilege logins to internal systems. From there they wrote forged withdrawal commands into the wallet system, which processed them as normal withdrawals and skipped the risk checks. Afterwards they deleted the traces (CONFIRMED that Bitget says this).

On 30 September, Mandiant and SlowMist published interim reports. They found the attackers had compromised two third-party security products, and SlowMist dates the earliest malicious activity in the logs to 31 August (REPORTED: CNBC, 2 October 2026). That is more than three weeks before the theft.

MINTGRAPHATTACK PATH · REPORTED

1. Zero-daysecurity product
2. Stolen loginstaff identity
3. Forged orderswritten to wallets
4. Signedvalid signatures
5. Funds out12 addresses

No private key was stolen, says Bitget. Its own system signed the transfers.

Source · Bitget incident page, Certora 5 Oct 2026

The odd part is the signature. Nobody stole a private key. Bitget's own signing system signed the transfers, because it trusted the orders it was fed. That is a reading by the security firm Certora, and it fits Bitget's account (REPORTED).

Where did the stolen money go?

BlockSec traced the path from Bitget's public tracking dashboard. It runs in three steps.

1. Stablecoins first. About $75 million in USDT, USDC and a gold token could be frozen by their issuers. All of it was swapped into ETH or AVAX within 41 minutes of being taken (REPORTED: BlockSec, 30 September 2026).
2. Then toward bitcoin. Funds on other chains were bridged into BTC, mostly through THORChain. About $269 million passed through it by 29 September. That is a pass-through total, so it is not the amount already laundered (REPORTED: BlockSec).
3. Then mixing. A small share went into Bitcoin CoinJoin mixers, about $3.9 million by 29 September (REPORTED: BlockSec).

As of 29 September the attacker still held about $342 million, 88.3% of the total. About 83.7% of that was BTC (REPORTED: BlockSec). XRP, the largest single item at roughly $157.8 million, has no issuer who can freeze it, and by 27 September most of it had been swapped to bitcoin (REPORTED: Certora).

MINTGRAPHLAUNDERING · REPORTED

1. StolenETH, XRP, ZEC
2. Swap41 min, stablecoins first
3. Bridgemostly THORChain
4. Bitcoin83.7% of holdings, 29 Sep
5. MixersCoinJoin, Zcash

Stablecoins can be frozen. So they went first. Native coins cannot.

Source · BlockSec 30 Sep 2026, Certora 5 Oct 2026

Some of the Zcash went into a privacy pool. The investigator ZachXBT flagged the first deposits into Zcash's Ironwood shielded pool on 30 September, about $3.8 million (REPORTED: Certora). On 28 September he also posted about the people he says are laundering for the attackers:

Show moreShow less

Posted by @zachxbt on 28 September 2026. Public when we checked on 15 October. It is his claim about the laundering groups, not proof of who the attackers are.

How much has been frozen or recovered?

Very little. BlockSec counted about $840,000 frozen by 29 September, 0.2% of the loss. Tether and Circle froze about $340,000, mostly stablecoins the attacker left sitting at an address. The cross-chain service NEAR Intents says it froze about $503,000 and refused to route more than $50 million (REPORTED). Our note on the NEAR Intents case covers that service.

Scam alertNEAR Intents $3.8M exploit: funds returned, what users should know→

On 2 October, Bitget's CEO Gracy Chen told CNBC the total frozen was about $1.1 million. Frozen is not returned. She said she was "not expecting to recover a lot of funds" (REPORTED: CNBC). THORChain declined Bitget's request to refuse the attacker's addresses (REPORTED: BlockSec).

Bitget offers a 5% bounty on funds frozen or recovered through help from outside parties.

Was it North Korea?

Likely, according to several firms. Not confirmed by any government. That is the honest summary, label REPORTED.

• Bitget's CEO said the techniques fit North Korea-linked groups (CONFIRMED that she said it). The IP evidence has not been published.
• Elliptic said on 25 September that laundering patterns suggest the group tracked as TraderTraitor. TRM Labs reported overlaps with wallets used in earlier North Korean hacks (REPORTED).
• On 1 October, Chainalysis called the thieves "DPRK-attributed threat actors" without publishing its basis (CONFIRMED that Chainalysis says this).
• The Mandiant and SlowMist interim reports do not name anyone. As of 2 October no government had formally blamed North Korea (REPORTED: Certora). BlockSec warns that shared laundering groups are not proof of shared attackers.

What is still unknown?

• Who the attacker is. Strong suspicion, no official finding.
• Which security products were breached. Bitget has not named the vendors. The CEO cited security risk.
• The full technical report. Bitget promised a formal report. We could not find it on 15 October.
• How much will ever come back. Funds are still moving, and on-chain trackers are the only live evidence.

What about the BGB token and the user fund?

Bitget says its Protection Fund held more than $464 million before the hack, fell below $200 million, and was restored to more than $300 million with Bitget's own money. Its 13 October page puts it at more than $314 million (CONFIRMED that Bitget says this; CNBC and Bloomberg reported the draw-down). Withdrawals for every asset were back by 2 October.

Bitget's own token, BGB, is listed on CoinGecko as bitget-token. The chart below is live market data, shown so you can see it for yourself. It is not a forecast, and MintGraph takes no view on the price.

Not financial advice. Live data from CoinGecko, as loaded when you open this page.

What this means for you

1. A balance on an exchange is a claim on the exchange. Here the exchange paid the loss from its own fund. That is Bitget's choice and its statement, not a rule.
2. Hacks attract scammers. Bitget says it will never ask you to transfer funds. It will never ask for a password, seed phrase or code to "recover" assets or "restore withdrawals" either. Our guide to fake recovery services shows how that second scam works.
3. Read news on official pages. Use Bitget's incident page below, not a link in a DM or a reply.

GuideFake crypto recovery: how the second scam works→

What MintGraph checked, on 15 October 2026: Bitget's incident page, BlockSec's tracing report, Certora's analysis, Chainalysis's blog post, CNBC's report, and the two X posts above. We did not trace any transaction ourselves.

Open Bitget's official incident pagebitget.com

MintGraph is not affiliated with Bitget. This is research and safety information, not financial advice.