# Bitget says spoofed transfer instructions, not stolen keys, drained $351.6 million from its hot wallets

Circle and Tether froze roughly $318,000 of the proceeds while the attacker converted stablecoins into ether, which no issuer can blacklist.

- Published: 2026-09-26T05:50:55.881Z
- Canonical: https://polylog.news/crypto/2026-09-26/bitget-says-spoofed-transfer-instructions-not-stolen-keys-dr
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/markets/2026/09/25/circle-and-tether-step-in-to-freeze-hacker-wallet-after-massive-bitget-crypto-heist), [crypto.news](https://crypto.news/bitget-hacker-swaps-usdc-for-eth-circle-faces-freeze/), [Bitcoin Magazine](https://bitcoinmagazine.com/news/north-korea-linked-to-bitget-hack), [CryptoSlate](https://cryptoslate.com/swiss-bank-shields-bitget-institutions-while-retail-funds-freeze/), [Polylog editors](https://polylog.news), [Bitcoin Magazine](https://bitcoinmagazine.com/news/bitget-suffers-352-million-hack)

Bitget has given the first technical account of the September 24 theft from its wallet infrastructure, and the account matters more than the size of the loss. Chief executive Gracy Chen said the attacker [compromised a backend system inside the wallet stack, spoofed transaction data and then triggered the exchange's own authorization process](https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says), rather than stealing signing keys. The exchange put the loss at about $351.6 million, detected unauthorized transfers at 18:31 UTC, and said cold wallets were untouched and that user balances remain intact. A Bitget representative said [the majority of the stolen funds came from hot wallets and that its Protection Fund can absorb the loss](https://t.me/BWEnews/16491).

The recovery picture shows how little of on-chain freezing power actually reaches a fast attacker. Circle and Tether [blacklisted a wallet holding roughly $318,000 in USD Coin (USDC) and Tether (USDT)](https://www.coindesk.com/markets/2026/09/25/circle-and-tether-step-in-to-freeze-hacker-wallet-after-massive-bitget-crypto-heist), a fraction of a percent of the total. Security researcher Taylor Monahan tracked the attacker [converting stolen USDC into ether](https://crypto.news/bitget-hacker-swaps-usdc-for-eth-circle-faces-freeze/) before those controls took effect, and ether has no issuer that can immobilize a balance. Centralized stablecoins are the only assets in this loss that a private party can seize, and they were the first thing the attacker sold.

Attribution remains unsettled. Bitget's chief executive [linked the theft to North Korean hackers](https://bitcoinmagazine.com/news/north-korea-linked-to-bitget-hack), citing internet addresses resembling virtual private network infrastructure previously associated with North Korean operators and behavior patterns seen in earlier cases. That is circumstantial evidence, and Bitget has said it will not make a formal determination before its investigation closes. Investigators benefit from naming a sanctioned actor because it unlocks state assistance, and the exchange benefits from a narrative of a state adversary rather than internal process failure. Neither motive settles the question.

Withdrawals return in stages. Bitget said it will [reopen bitcoin withdrawals on September 28, ether on September 29, USDT on September 30 and remaining tokens and fiat on October 2](https://t.me/BWEnews/16494), with security checks continuing. In the interim, the custody split became visible: the Swiss bank Sygnum offered institutional clients bank-held trading collateral, while [ordinary customer balances stayed dependent on Bitget's own controls and its insurance fund](https://cryptoslate.com/swiss-bank-shields-bitget-institutions-while-retail-funds-freeze/). Bitget [first disclosed the unauthorized transfers and halted withdrawals on September 24](https://bitcoinmagazine.com/news/bitget-suffers-352-million-hack).

## What this means

The failure surface here was an operational system that did exactly what it was built to do: it authorized transfers that arrived with valid-looking instructions. Exchange customers and counterparties are exposed through the exchange's balance sheet. The only fast mitigation available to anyone was stablecoin blacklisting, which reached about $318,000 of the $351.6 million stolen. The precedent is the February 2025 Bybit theft, where investigators pointed to North Korean operators and most of the stolen ether moved through swaps and mixers well ahead of any freeze, and where the exchange covered customer balances from reserves and third-party loans. The likelier outcome over the coming weeks is that most of these funds are not recovered, Bitget honors balances from its Protection Fund, and institutional flow shifts further toward bank-custodied collateral arrangements of the kind Sygnum is marketing. What would prove that wrong is a meaningful clawback, which would require centralized venues on the attacker's exit path to cooperate before the ether is laundered.

## What to watch

- Whether Bitget's staged withdrawal restart runs on schedule from September 28, because any slippage would suggest the wallet infrastructure problem is broader than the backend system already described.
- How much of the stolen ether reaches centralized exchanges or mixing services, which determines whether freezing power ever extends beyond the small stablecoin balance already blacklisted.
- Whether Bitget publishes a full post-mortem naming the compromised backend component, since other exchanges run comparable transaction-authorization pipelines.