Q&A: Last Week, Bitget Suffered the Biggest Crypto Hack of 2026. The Exchange's CEO Explains What Happened

By Joe StonorToward the end of last week, digital assets exchange Bitget suffered the largest cryptocurrency hack of 2026.The hack saw around $388 million taken from users' so-called hot and warm wallets--digital currency wallets that connect to the internet. All impacted customers will be made whole by Bitget funds set aside for such incidents, the exchange said.The attack is the first Bitget has suffered in its eight-year history, but cryptocurrency hacks aren't rare: Around $319 million were stolen from blockchain Liquid Network earlier this month, while crypto data platform DeFiLlama puts the total value of hacked assets across the industry at above $21 billion. (Liquid Network-owner Blockstream said it had identified and fixed the vulnerability behind the attack, and that it continues to strengthen the security of its network.)In an interview, Bitget chief executive Gracy Chen explained what happened. The following has been edited for length and clarity.Q: What happened?A: Starting at 1831 UTC on Sept. 24, there were unauthorized transfers involving certain assets made across multiple chains from Bitget's hot and warm wallet. At first, there were only two [transfers in] very small asset classes [which] didn't trigger a system alert. But within half an hour, at 1858 UTC, the attacker started to initiate large transfers. Within slightly more than an hour, the attacker initiated 17 large transfers across Ethereum, XRP, ZEC, BSC, BASE, ARB, Optimism, and Avalanche [cryptocurrencies] with a total value of approximately $361 million-the main amount of loss that we incurred.Seven minutes after the large transfers began, our platform's reconciliation system detected a significant discrepancy, and the risk system automatically blocked user-initiated withdrawals platform-wide. But that didn't stop the hacker, because the hacker wasn't going through a normal way of withdrawal.Q: How did the hacker get into Bitget's systems?A: The attacker bypassed our existing risk control systems. They found a vulnerability in our third-party security products, and through that vulnerability, they obtained our internal network credentials so that they could use these credentials to send fraudulent withdrawal commands to the wallet system. The transfers were executed while bypassing our existing risk control system.Q: Can you name the third-party provider? And is Bitget still working with the provider?A: I can't disclose that information until the independent incident report is released [which Chen expects to publish before the end of the week]. We are not using these third-party product or products anymore, but we are working with them on how to solve this vulnerability.Q: Will any customers lose funds?A: No, because of the Bitget Protection Fund which we set up in 2022 before the FTX collapse. After the Protection Fund is used to cover the hack, we are going to use our company's set-aside own capital to replenish the fund back to more than $300 million…within a week.Q: Did Bitget have any insurance to cover a situation like this?A: Not in this case.Q: How significant a blow is the hack to Bitget's operations?A: The impact of this incident on our day-to-day operation and profitability is actually very limited. Even during the incident, other than withdrawal, anything else pretty much operated normally.As well as the $465 million we had in the protection fund [held in bitcoin], we also have more than $1 billion in our corporate funds. $388 million is, of course, a big chunk of our corporate funds, but we still have a lot of additional corporate reserves.We also issued a notice to all our employees-slightly less than 2,200 employees-that even if this is a very tragic incident, we won't do any sort of layoff, or stop operations.Q: Do you worry about the reputational impact of this hack on Bitget?A: This is an important milestone or crisis. Our current mindset is more about turning crisis into an opportunity to be stronger. For me, this is just a small setback that will not change what we set out to do or what we believe in.Bybit also had a $1.4 billion-plus hack last year [in February 2025, reportedly the largest crypto hack in history], but if you look at them eighteen months later, they are still around the same ranking among exchanges, right? I expect the same thing to happen with us.(Bybit didn't immediately respond to a request for comment.)Write to Joe Stonor at [email protected]