Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Global Financial Service Disruptions

Bitget

crypto exchange · SC · Global · not stated

Confirmed cyberStatus: unknownTier 1Severity 4 of 5Evidence confidence: highAnalyst-verified

Bitget suspended all withdrawals after a USD 387.5M hot wallet theft on 24 Sep 2026. The halt began before the window but persisted into it: other tokens, fiat and P2P withdrawals were scheduled to return on 2 Oct. Bitget blamed a vulnerability in a third-party security product.

First disruption
Sep 24
First public signal
Sep 24 (Bitget confirmation of unauthorized hot/warm wallet transfers)
Acknowledged
Sep 24
Restored
not yet
Duration
not established
DFX first recorded
Nov 5 14:58 UTC

What was restricted

withdrawalspayoutsScope: institution wide

All customer withdrawals suspended from 24 Sep; phased reopening BTC 28 Sep 08:00 UTC, ETH 29 Sep, USDT 30 Sep, other tokens plus fiat and P2P scheduled 2 Oct (inside window). Deposits and trading continued. About USD 463M customer outflows reported.

Financial impact: USD 387.5M stolen (Bitget revised from 351.6M); covered by User Protection Fund (confirmed by institution).

Cause, kept in separate layers

What the institution said
Attackers exploited a vulnerability in a third-party security product to obtain privileged internal credentials and send fraudulent withdrawal commands; private keys and cold wallets secure.
DFX classification
Confirmed cyber (cyber: confirmed)
Analytical hypothesis (not established)
Suspected DPRK involvement reported by press, unconfirmed.
Conflicting reports
Began 24 Sep, before the 1 Oct window start; included because the restriction continued into the window (2 Oct scheduled return of other tokens, fiat and P2P; completion of every category not confirmed in sources read). Loss 351.6M (initial) vs 387.5M to 390M.

Dependencies

A dependency is a documented relationship. It is not evidence that the provider was compromised.

  • Provider: Unnamed third-party security product (exploited to obtain internal credentials), verified

Evidence