Biggest Hack of 2026

The biggest crypto hack of the year just happened, and the scariest part isn't the size of it. It's how they did it. Nobody stole a key. Nobody broke any code. Attackers walked in the back door, forged some paperwork, and Bitget's own systems handed over $387.5 million as if it were a routine Tuesday.

If you only read this

• Bitget, one of the world's biggest crypto exchanges, lost about $387.5 million on Thursday. It's the largest crypto hack of 2026 by a wide margin, and it happened to an Asia-based exchange.
• They didn't steal the keys. Attackers broke into a back-office system and faked transfer instructions convincing enough that Bitget's own approval process signed off. Cold wallets and customer keys were never touched.
• Users are covered, but the lesson is bigger than one exchange. Bitget's $464 million reserve fund covers the loss. The real takeaway: the dangerous attacks now target the process, not the cryptography.

What happened

On Thursday, roughly $387.5 million walked out of Bitget.

Bitget's systems flagged unauthorised transfers leaving its wallets late Thursday. The first count was around $351 million. By the next day the tally had climbed to $387.5 million as investigators traced funds across multiple blockchains, including large amounts of Ethereum and XRP. DefiLlama now ranks it the single biggest crypto hack of 2026, and it made September the most expensive month for crypto theft all year.

This is not a small player. Bitget is one of the largest exchanges in the world, with more than 120 million users. When something this size gets hit, the whole industry feels it.

How they did it, in plain English

Think of an exchange like a bank vault with a very strict approval process.

Normally, to move money you'd need the vault combination, which in crypto means the private keys. Steal the keys, steal the money. That's the attack everyone guards against, and it's the one Bitget actually prevented: its keys were never stolen, and its cold wallets (the ones kept offline) were untouched.

Instead, the attackers did something cleverer. They broke into a back-office system that Bitget uses to process transfers, and they forged the transfer instructions. The paperwork looked so legitimate that Bitget's own system approved the payouts without realising anything was wrong. As the CEO put it, nobody stole the vault combination. Someone forged paperwork convincing enough that the system signed off on it.

That distinction is the entire story, and it should worry you more than a normal hack. This wasn't a flaw in crypto's math. It was the human process around the money being tricked.

Why this keeps happening

The target has moved.

For years, the industry poured its effort into making the cryptography unbreakable, and it largely succeeded. So attackers stopped trying to break the code. They went after the softer stuff instead: the people, the internal tools, the approval systems. We saw it with the Coldcard wallet drain earlier this year, where the flaw was in how keys were generated, not in Bitcoin itself. Now we're seeing it at exchange scale, where the flaw was in how transfers get approved.

The pattern is clear. The lock got too good, so the thieves learned to fake the paperwork instead. And as AI makes it cheaper to study a company's systems and mimic their internal signals, this kind of attack gets easier, not harder.

The North Korea question

Bitget's CEO says the evidence points to North Korea, but nobody has confirmed it yet.

CEO Gracy Chen said the IP patterns and on-chain behaviour behind the attack match techniques used by North Korean state-linked hacker groups, and that some of the internet addresses traced to VPN services those groups have used before. She was careful to call it consistent with their methods, not proven. Law enforcement is now investigating.

The context makes it plausible. North Korea has become the most prolific hacker in crypto, blamed for a record $2 billion in thefts in 2025, and this single hack reportedly pushes its 2026 haul past $1 billion. It's widely believed the country uses stolen crypto to fund itself around international sanctions. So the suspicion is reasonable. It just isn't confirmed, and it's worth holding it that way.

The part Bitget got right

How an exchange responds to a hack matters as much as the hack itself, and this response was, so far, a mature one.

Customer balances are safe. Bitget says its User Protection Fund, worth more than $464 million, fully covers the loss, so users don't eat it. Withdrawals were paused as a precaution while security is reviewed, but deposits and trading stayed open, and a plan to reopen withdrawals is due within days. Bitget also launched a recovery bounty, offering 5% to anyone who helps freeze or recover the stolen funds, and some blockchain platforms have already frozen part of the money.

Compare that to the exchange collapses of past cycles, where users simply lost everything overnight. A funded reserve and a transparent response is the difference between a bad week and a death sentence.

The Asia read

This is an Asian exchange, hit at the exact moment Asia is writing the rulebook for how crypto should be held.

Hong Kong and Singapore are busy building licensing regimes for custody, the business of safely holding other people's crypto. The Bitget hack is the clearest argument yet for what those rules need to cover. The old security question was "are your keys safe?" This hack proves that's no longer enough. The real question now is "can your own systems be tricked into approving a transfer that never should have happened?"

For you: if you run or rely on any platform in this region, that's the question to be asking. Not just where the keys are stored, but who and what can trigger a movement of funds, and what independent check stands between a forged instruction and a real payout. A trusted brand name, as Bitget's users just learned, is not the same as a trustworthy process.

Our read

The biggest theft of the year didn't break a single piece of cryptography. It walked in through the back office. That's the whole message, and it's the one the industry keeps having to relearn: your keys can be perfect and you can still lose everything if the process around them can be fooled.

The firms that come out of this era standing won't be the ones with the best marketing about security. They'll be the ones who treated the entire path a transaction takes, every system and every approval, as the thing worth defending, not just the vault. As the attackers get cheaper, faster tools, that gap between looking secure and being secure is where the next $387 million goes.

This is the part of the industry I spend my days inside, building custody and settlement infrastructure across Asia, so I'll say the quiet thing plainly: most firms are still guarding the vault door while the thieves have moved to the mailroom. If you're building an institution here and you're not certain which one you're defending, that's the conversation worth having before you become the headline.

Disclosure: I work on the infrastructure side of this industry. Market intelligence for independent decisions, not financial advice.