What happened in the September 2026 Bitget theft, and were customers' funds affected?

The full answer

What did Bitget say happened on September 24, 2026?

24/7 Wall St. reported on September 27, 2026 that hackers took $351.6 million from Bitget [1]. Bitget said in its official incident update, last updated September 30, 2026, that its cold wallets were unaffected. 24/7 Wall St. gave the same $351.6 million figure on September 27, 2026, and described the breach as linked to North Korea [3].

The 103 million XRP figure is what Bitget reported on September 24, 2026, as relayed by 24/7 Wall St. on September 27, 2026, which separately put the total at $351.6 million.

How did the attacker move funds without stealing private keys?

CNBC reported on September 25, 2026 that Bitget’s security team found the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Bitget CEO Gracy Chen said private key compromise had been ruled out.

FINRA notes that hot wallets, like any service connected to the internet, are vulnerable to hackers and malicious code.

Was XRP stolen, and can it be frozen or reversed?

Yes. 24/7 Wall St. reported on September 27, 2026 that Bitget reported the loss of 103 million XRP on September 24, 2026 [2]. 24/7 Wall St. put it at 103 million XRP and said much of the stolen value sits beyond the reach of any organization that might try to stop it [3].

XRP itself cannot be frozen on the ledger. XRPL.org says no one can freeze XRP on the XRP Ledger, though custodial exchanges can freeze funds they hold at their own discretion [4]. Ripple says it has no ability to stop or alter XRP Ledger transactions [5]. XRPL.org adds that no administrator can undo a transaction once it has been applied [6]. The FBI says crypto transactions are irrevocable, though law enforcement can trace them on public blockchains. It warns that tracing gets much harder once funds move to exchanges in other jurisdictions [7]. More detail is on the page about whether XRP can be frozen or taken back.

Were customers’ funds affected?

CNBC reported on September 25, 2026 that Bitget CEO Gracy Chen said the loss is fully covered by the exchange’s User Protection Fund, which holds more than $464 million. On Bitget’s account, the exchange’s own reserves absorbed the theft and customer balances were not cut.

That protection was Bitget’s decision and was paid from Bitget’s own fund.

What protection do customers have if an exchange does not cover a loss?

Government schemes offer little. The Ontario Securities Commission’s investor site, updated September 8, 2025, says the Canadian Investor Protection Fund does not cover crypto losses when a trading platform goes insolvent [9]. The same page says Ontario does not let a trading platform keep all its clients’ crypto in its own hot or cold wallets. At least 80% has to sit with an acceptable third-party custodian [9]. The FTC says that if an exchange goes out of business, no one is likely to be able to step in and help recover the funds [10]. The page on whether crypto is insured like a bank account sets out each scheme.

Does this case show that holding your own keys is safer?

Not on its own. The strongest point against reading it that way is that Bitget customers were shielded by the exchange in this case. A person holding their own keys has no company behind them. XRPL.org says no one can restore access to an XRP Ledger account if something goes wrong [11]. The FTC says the same applies if a digital wallet is lost, stolen or compromised [10].

So exchange custody exposed customers to the risk of a platform breach. The Ontario Securities Commission’s investor education site said in September 2025 that CIPF does not cover losses of crypto assets if a crypto asset trading platform goes insolvent. Self-custody removes that platform risk and puts every loss on the holder. The page on whether to keep XRP on an exchange or in your own wallet sets the two positions side by side. Coin Alert News reported on September 23, 2026 that a D’CENT app wallet breach drained nearly $20 million in XRP from 6,678 wallets; see the D’CENT wallet drain.