$351.6 Million, Three Hours, No Kill Switch

At 18:31 UTC on September 24, Bitget's monitoring systems lit up. Money was leaving hot wallets that weren't supposed to be moving. (cite index="47-4,47-5">"At 18:31 UTC on September 24, 2026, Bitget's security systems detected unauthorized transfers from some of our hot wallets," Bitget CEO Gracy Chen wrote on X. "Our security team activated emergency response protocols immediately."

"Immediately" is doing a lot of work in that sentence.

The Clock Nobody Wants to Talk About

On-chain analysis tells a slower story. (cite index="14-2,14-3">The drain ran for almost three hours after detection, with the last transfer two hours and 52 minutes after the detection timestamp and seven minutes before the notice was published. (cite index="14-4">During that window, $133.4 million left Bitget-labelled wallets across Ethereum and Arbitrum alone, plus 3,000 Tether Gold tokens worth $12.8 million from a third address.

Translation: Bitget's security team saw the theft happen in real time and still needed three hours to stop money from leaving.

Bitget says the attacker never touched a private key. (cite index="10-1,10-2">The attacker got into a backend system inside its wallet infrastructure, used it to spoof transaction data, and tricked the exchange's authorization process into releasing funds. That's a more embarrassing failure than a stolen key. The cryptography held. The system that decides what the cryptography signs did not.

This wasn't a security failure. It was a detection-speed failure wearing a security failure's clothes.

The Getaway Car Tells You Everything

Watch what the attacker converted the stolen money into. (cite index="14-11,14-12,14-13,14-14">Tether can freeze USDT. Circle can freeze USDC. Tether can freeze its gold token. Ether cannot be frozen by anyone. (cite index="14-11,14-12,14-13,14-14">Within minutes, a fresh wallet had already turned nearly $20 million of stablecoin into ether specifically because it can't be clawed back. That is not opportunism. That is someone who mapped which assets Bitget and its partners could still kill after the fact, and chose accordingly.

Attribution to North Korea's Lazarus Group is circulating hard, based on IP and VPN pattern matches Chen described on a livestream. It is not confirmed. (cite index="22-1,22-5">No government agency had publicly attributed the Bitget breach to North Korea, and Chen's comments represent Bitget's preliminary suspicion, not a confirmed attribution. Treat it as a strong lead, not a verdict.

What isn't speculative is the pattern. (cite index="53-12,53-13">Bybit lost $1.5 billion in 2025, and Bitget lost $350 million in 2026, with 19 months between incidents. (cite index="53-14,53-15,53-16">The security of hot wallets remains the weakest link for centralized exchanges, and a hot wallet connected to the internet is an attack surface — a problem that gets re-prioritized after each hack and relaxed again once trading volume pressure returns.

Bitget says it can absorb the hit. (cite index="49-8">"User funds are safe," Chen wrote on X, adding that the loss falls within Bitget's User Protection Fund, which holds over $464 million. That fund's actual composition and enforceability, like every exchange's protection fund, has never been independently audited in public. Believing it works because a CEO tweeted a number is the same trust exercise that got you into this article.

What to watch: whether Bitget's promised 24-hour incident report actually specifies detection-to-containment timing rather than just the dollar figure; whether any stolen assets sitting in freezable tokens actually get frozen; whether regulators in Singapore or Hong Kong start asking exchanges for containment-time SLAs instead of just proof-of-reserves; and whether any competing exchange volunteers its own detection latency instead of just pointing at Bitget's.