Bitget exploit: $387M stolen and laundered via Discord and Telegram

Approximately $387.5 million was stolen from Bitget in a September 24 breach, marking it as the largest digital asset theft of 2026. The attackers compromised a third-party backend system to spoof transaction data and bypass internal authorization, though Bitget confirmed that private keys and cold wallets remained secure.

Blockchain investigator ZachXBT has identified that the stolen funds are being laundered through public Discord servers and Telegram channels. The actors are reportedly using bridging services and mixers, such as Wasabi, to obscure the transaction trail. Some individuals involved have been linked to North Korean-affiliated groups, including aliases like TraderTraitor and Lazarus. Additionally, at least one actor has been connected to the previous $292 million Kelp DAO exploit.

Bitget has suspended and subsequently resumed withdrawals in phases, stating that its User Protection Fund, which exceeds $464 million, will cover user losses. The exchange is also offering a 5% bounty for the recovery of the lost assets. Forensic investigations are being conducted alongside Mandiant and SlowMist.