On the evening of September 24, 2026, Bitget's systems flagged money leaving its hot wallets that nobody had approved. By the time the exchange had a number, roughly $351.6 million was gone across eight blockchains. A day later Bitget raised that figure to about $387.5 million after counting outflows on Zcash and TRON it had missed the first time. That makes it the largest crypto hack of 2026 so far.
The exchange says the loss is covered by its User Protection Fund and that customer balances weren't touched. The bigger story is who did it. Our tracing at Merkle Science ties the stolen funds back to the AFX bridge exploit from July. Investigators had already linked that attack to TraderTraitor, the North Korean group also tracked as UNC4899.
The attackers didn't steal Bitget's private keys. They got the exchange to sign the transactions for them.
Bitget's initial statement said someone had broken into a key backend system in its wallet service. From there, the attackers forged transfer details and pushed them through the normal authorization and signing process. The system signed those withdrawals as if they were real.
A few days later Bitget explained how they got in. A vulnerability in a third-party security product handed the attackers high-level internal credentials. With those, they could issue fake withdrawal commands that slipped past the exchange's risk controls. Bitget hasn't named the vendor.
Bitget says its private keys and cold wallets were never exposed. It runs a three-layer wallet setup, and only a small number of hot wallets were hit. Because no keys leaked, there's nothing left for the attackers to come back and reuse. Bitget Wallet, its separate self-custody product, wasn't affected either.
Bitget moved quickly. Its emergency team was working the incident within minutes of the 18:31 UTC alert (just after midnight IST on September 25). It froze withdrawals, flagged the receiving addresses, and called in law enforcement along with other security firms. Trading and deposits stayed open the whole time.
The exchange says its User Protection Fund, which held more than $464 million before the attack, covers the full loss. Reports since then put the fund below $200 million, so it absorbed a large share of the hit. Bitget says some stolen assets have been frozen with help from other firms, but it hasn't said how much.
Withdrawals came back in stages:
The pressure showed. DefiLlama data cited by Crypto Briefing shows $463 million in net outflows on September 29 alone. Bitget has said the flaw is fixed and that a full security report is on the way.
The first wave of outflows hit eight networks: XRP Ledger, Ethereum, BNB Smart Chain, Base, Optimism, Avalanche, Arbitrum, and TRON. Bitget's revised count adds Zcash. Most of the value taken was USDT, USDC, ETH, and Tether Gold (XAUt), with XRP, ZEC, BNB, AVAX, and TRX also on the list.
The single biggest outflow was on XRP Ledger, where 20 million XRP left one Bitget wallet. The attacker kept things simple on the receiving end: one address on XRP Ledger, one on TRON, and a single address reused across every EVM chain.
The attacker's first move was to get rid of anything that could be frozen. Tether, Circle, and the XAUt issuer can freeze their tokens. Nobody can freeze ETH, BNB, or BTC. So the stolen USDT, USDC, and XAUt went through several DEX liquidity pools fast, and most of the value now sits in native assets.
On BNB Smart Chain, funds fanned out from one distribution wallet to about a dozen intermediate addresses. From there:
On September 26, Bitget's CEO asked THORChain to stop serving the attacker's addresses. THORChain declined, saying its design doesn't allow it to censor transactions.
On Ethereum, the attacker is sitting on a large reserve. At the end of September 24 (UTC), eight wallets held 67,809.92 ETH between them. Six held almost exactly 10,000 ETH each, and the other two held 4,596.47 ETH and 3,213.45 ETH. None had sent anything out at that point.
We've seen this playbook before. The stablecoins only stay put long enough to be useful: USDC, in particular, bridges easily, so it gets used as a carrier to hop across several bridges before being swapped back into native assets. It's the same laundering pattern TraderTraitor has used in earlier operations.
The on-chain trail points to the same people who hit AFX in July.
On July 22, 2026, attackers drained about $24.15 million in USDC from AFX Trade's bridge after getting hold of its validator signing keys. Two days later, other firms said the attack was highly likely the work of UNC4899, better known as TraderTraitor. They also connected the gas funding for the AFX attacker to the KelpDAO exploit.
Here's where Bitget comes in. Part of the stolen XRP passed through two XRP Ledger wallets and was bridged to an Ethereum address. That address shares a direct counterparty with the wallet that paid gas to the AFX exploiter on July 25, the same day the AFX proceeds were pulled together.
Put simply, the wallets that funded the AFX attacker also touch the wallet that received Bitget's stolen XRP. Add the familiar multi-bridge laundering and it looks like one crew behind both.
Bitget's own read lines up. CEO Gracy Chen said early indicators, including IP addresses tied to VPN services the group has used before, point to North Korean hackers. She's been careful to call that preliminary while the investigation by other firms continues.
Merkle Science spotted the unusual outflows from Bitget-controlled wallets as they were happening, before Bitget confirmed the breach. Our team started labeling the attacker addresses right away and has been following the funds ever since.
This is routine work for us. Our team tags attacker and laundering addresses as incidents unfold and keeps those labels current, so compliance teams can see exposure in their own flows without having to chase every hop themselves. Every address tied to the Bitget exploit is now labeled in the Merkle Science platform. That includes the initial receiving wallets, the Ethereum holding wallets, and the Bitcoin addresses downstream of the THORChain swaps.
If you screen transactions with us, exposure to this exploit will show up as the funds move. A few things worth doing now:
We'll keep following the money and update our labels as it moves. Clients who want the full address list can get it through the platform or by reaching out to our team.
