No Stolen Key, $351 Million in an Hour — Bitget's Hot-Wallet Breach and the Trust Boundary of the Approval Flow

At 18:31 UTC on September 24, 2026, Bitget's security systems flagged unauthorized transfers from a portion of its hot wallets, and emergency response procedures were activated within minutes. On the 25th, CEO Gracy Chen stated publicly that the affected assets total approximately $351.6 million. Bitget's wallet structure is three-tier (hot / warm / cold); per the exchange the breach is confined to parts of the hot and warm layers and did not reach the offline cold wallets, and customer account balances remain consistent with their holdings. Withdrawals are temporarily suspended while trading and deposits continue. The exchange reports it identified and flagged the recipient addresses, notified law-enforcement agencies, and engaged blockchain-security firms to trace the funds, and that a full incident report — covering root cause and corrective steps — would follow within 24 hours of the initial notice (per Gracy Chen's X statement, Bitget's official security notice, Cryptopotato, InvestingLive, and CyberSecurityNews).

On the attack path, Bitget's account is that the attacker reached a backend system inside its wallet infrastructure, spoofed transaction data, and thereby steered the approval process into releasing funds. In other words, per the exchange, it is not a leak of the private keys that control the wallets themselves. Early estimates from on-chain researchers (analysts such as Arkham Intelligence) ran $174M–$183M, about half the confirmed figure; on-chain observers tracked movements involving ETH, BNB, AVAX, USDT, and USDC. One notable transaction, reported by Decrypt: a newly created wallet swapped roughly $19.7M of USDT0 (Tether's cross-chain version) into 7,111 ETH in about six minutes, paying up to 5% above market price to push the swap through quickly. The exchange's User Protection Fund holds $464M, exceeding the loss, and Bitget has committed to covering the full amount from it. TFTC notes the fund's asset mix has not been independently verified.

On attribution: on-chain investigator Specter has claimed the North Korea-linked Lazarus Group is behind the attack, and HackRead reported that Bitget suspects the group's involvement, while Bitget has itself declined to attribute formally, per reporting that it 'declined to speculate.' It is appropriate to characterize current attribution as a 'suspicion,' not an 'attribution.' As context, Lazarus-affiliated groups are reported to have been involved in many of the largest exchange breaches in recent years — Bybit's $1.5B in February 2025 (the FBI attributed it to Lazarus), DMM Bitcoin's ~$308M and WazirX's ~$234.9M in 2024. Per Chainalysis, 2025 crypto theft totaled $3.4B, of which $2.02B (over 60%) was estimated North Korea-linked. In the first half of 2026 alone, $1.1B was taken across 212 incidents, a majority attributed to the Lazarus Group. This incident's rapid multi-chain dispersion, immediate conversion to ETH, and entry via an internal system without a key leak match operational signatures of state-linked groups — but technique similarity is not evidence of identity.

Analysis (separated from facts): what matters is that 'the keys were not stolen' is not necessarily a good outcome. Per Bitget's account, the attacker did not take the signing keys but reached the backend system that feeds data into the approval process, and spoofed transaction data. What was broken is not the cryptographic boundary (the keys) but the trust boundary (the source of information for the approval decision). This is isomorphic to the 'management and identity plane' theme this observatory has covered in the last two weeks — F5 BIG-IP APM's OAuth zero-day (the identity-issuing side RCE'd unauthenticated), Cisco ISE's management-API auth bypass (CVSS 10.0), and Secure Email Gateway's root reach via parsing code — all sharing the structure: when the plane that makes the decision itself is captured, the decision can no longer be trusted. The wallet infrastructure's approval flow is precisely such a decision plane; the integrity of the balances and transaction data it is given, and the authority of internal systems that can create or alter withdrawal requests, define the trust boundary. The 24-hour report, if it shows which backend system was compromised, to which approvers the spoofed data appeared, and whether multi-step approval could distinguish 'the spoofed data path' from 'a genuine request,' will make the point of failure more concrete. Until then, it is appropriate to model the failure as 'compromise of the data path into the approval process.'

Defensive implications: (1) Operations holding on-chain assets should treat the approval pipeline itself as a first-class trust boundary — not just key custody, but the provenance of transaction data (authentication/attestation at the API layer, per-approver independent data views, multi-signature with independent views) as a design requirement. (2) Set withdrawal velocity and per-chain caps together, and monitor on-chain anomalies (abnormal swap speed, abnormal spread versus market price) as real-time triage signals — this incident's USDT0 → ETH in ~6 minutes at up to 5% premium is exactly that kind of signal. (3) Because multi-chain dispersion weakens freezing effects, pre-agree freezing/tracing channels with bridge and DEX counterparties. (4) Suspending withdrawals, fast disclosure, and the compensation commitment limit secondary damage — but compensation is only as strong as the independent verifiability of the fund's size and asset mix, so keep that verifiability maintained day-to-day. Facts here draw on Gracy Chen's X statement (https://x.com/GracyBitget/status/2103235655879074084), Bitget's official security notice (https://www.bitget.com/support/articles/12560603896024), Cryptopotato (https://cryptopotato.com/bitget-reports-351m-hot-wallet-breach-says-user-funds-are-covered/), InvestingLive (https://investinglive.com/cryptocurrency/hackers-drain-351-6-million-from-bitget-in-possibly-2026-s-biggest-crypto-heist/), CyberSecurityNews (https://cybersecuritynews.com/bitget-hot-wallet-hacked/), shattered.io (https://shattered.io/bitget-hack-351-million-2026/), and HackRead (https://hackread.com/bitget-hack-suspects-north-korea-lazarus-group/). Analysis is kept separate from reporting.