Crypto exchange Bitget suffered a security breach on Thursday night that resulted in the theft of more than $387 million, marking the largest cryptocurrency hack of 2026 so far, according to fortune.com. The attack targeted Bitget’s backend system used to process wallet transactions, enabling fraudulent withdrawals that appeared legitimate. Bitget has paused withdrawals and fixed the vulnerability while reviewing platform security.
Bitget CEO Gracy Chen explained during a three-hour livestream on X that the attackers did not steal private keys but manipulated the internal approval system to authorize transfers. The unauthorized withdrawals were limited to Bitget’s hot and warm wallets, which are company-controlled pools used for customer trades and withdrawals. Bitget Wallet, a self-custodial product where users control their crypto, was not affected. The loss estimate was revised after identifying additional transactions on the Zcash and TRON blockchains.
North Korea has emerged as a major hacking threat in the cryptocurrency sector, with groups linked to the country responsible for multiple high-profile cyber thefts. The $387 million stolen from Bitget surpasses other crypto heists this year, underscoring persistent security challenges for exchanges managing large volumes of digital assets. Bitget’s native token BGB initially dropped nearly 7% following the breach but has since partially recovered.
Bitget’s CEO confirmed the company has addressed the exploited vulnerability and continues to enhance security measures. Withdrawals remain paused as the platform completes its review. The incident highlights ongoing risks in crypto exchange operations, especially involving hot wallets that facilitate customer transactions.