Crypto exchange Bitget has confirmed a $387.5 million loss from a security incident, the largest single exchange breach disclosed so far in 2026, and it happened through an internal authorization failure rather than a stolen key.
Bitget said an attacker compromised a critical backend system within its wallet infrastructure and used it to spoof transaction data, tricking its own authorization process into approving withdrawals it should have blocked. The company initially estimated the loss at $351.6 million before raising the confirmed total after tracing additional balances. Cold wallets were not touched; the breach stayed within hot and warm wallet layers. Bitget engaged outside firms Mandiant and SlowMist to independently validate the incident and says its Protection Fund covers the shortfall, with user account balances unaffected.
Why It Matters
The distinction Bitget is drawing, no private keys stolen, only spoofed authorization, matters because it shifts the story from “customers should have used better security” to “the exchange’s own internal controls failed.” That is harder for the industry to wave away, since the compromise sits entirely on the platform’s side of the ledger. Withdrawals are resuming in stages: Bitcoin on September 28, Ethereum and layer-2 networks the next day, USDT across multiple networks on September 30, and remaining tokens, fiat and P2P by October 2.
The Insight
That staged, dated, publicly posted resumption schedule, paired with naming outside auditors before reopening withdrawals, is becoming the de facto incident-response template other exchanges reach for after a breach, whether or not any regulator requires it. Exchanges are effectively self-regulating their own disclosure choreography, because recent breaches of this size have shown an open, dated timeline holds users better than a vague “under investigation” statement.
Bitget’s case follows other crypto compliance moves this quarter, including the CFTC’s expanded crypto compliance FAQs and New York’s case against Polymarket, as authorities keep pressing on how crypto platforms police themselves.
Source: Bitget Support Center
