$351M Bitget Hack & $5.7M NFT Rescue Highlight Crypto Risks
Two unrelated crypto security incidents exposed very different weaknesses on September 25, putting both centralized exchange infrastructure and long-standing on-chain permissions under scrutiny.
Summary:
- Bitget lost $351.6M after attackers breached internal wallet infrastructure.
- A separate contract flaw exposed NFTs through old user approvals.
- White hats secured 23,155 NFTs worth more than $5.7M.
Bitget is investigating approximately $351.6 million in unauthorized transfers from its exchange wallet infrastructure. CEO Gracy Chen says private keys were not compromised, with preliminary findings instead pointing to a breach of a critical backend system.
刚才上午跟大家做了个三个多小时的直播，这里总结一下直播中聊到的点：
① Bitget 安全事件12小时进展通报。以下为具体信息，不打官腔。
— Gracy Chen @Bitget (@GracyBitget) September 25, 2026
Separately, a vulnerability involving Limit Break’s Payment Processor put NFTs held in user wallets at risk. A white-hat operation ultimately secured 23,155 NFTs worth more than $5.7 million before they could be taken.
The incidents are technically separate, but the contrast is significant. Bitget users entrusted their assets to a centralized custodian, while the NFT holders retained their own wallets but had previously given smart contracts permission to move assets.
Bitget Says the Attacker Never Obtained Its Private Keys
Bitget detected unauthorized transfers at 18:31 UTC on September 24, eventually identifying approximately $351.6 million in affected assets.
The exchange’s preliminary investigation points away from a conventional private-key theft.
Chen said attackers compromised a critical component of Bitget’s internal wallet infrastructure and manipulated transaction information before fraudulent transfers were authorized. She said private keys controlling Bitget’s hot, warm and cold wallets remained secure.
That distinction changes the technical investigation.
A stolen private key gives an attacker direct cryptographic authority to sign transactions. A backend compromise can produce a different failure: the keys remain protected, but legitimate signing infrastructure receives malicious transaction instructions from another system it trusts.
Bitget has not yet disclosed the initial access method or enough forensic information to establish exactly which internal component was compromised. Claims that a specific API, database or signing service was exploited therefore remain unconfirmed.
XRP Was the Largest Identified Part of the Theft
On-chain tracking from Arkham provides a clearer picture of the assets that left Bitget.
Approximately 102.9 million XRP worth around $158 million represented the largest identified component. Tens of thousands of ETH and significant amounts of USDT, USDC and other assets were also transferred across several networks.
Some of those assets were converted almost immediately.
One address used approximately $19.67 million in USDT0 to acquire 7,111 ETH on Arbitrum in around six minutes, routing the transactions through decentralized trading infrastructure.
The speed of those conversions is notable because issuers can potentially freeze certain centralized stablecoins. Native ETH has no equivalent issuer capable of freezing an address, giving an attacker an incentive to move out of freezeable assets quickly.
Bitget says attacker-linked addresses have been flagged and that law enforcement and blockchain security firms are assisting with the investigation.
North Korea Is a Lead, Not a Confirmed Attribution
The investigation has also turned toward the identity of the attackers.
Chen said investigators identified IP addresses with VPN usage patterns resembling infrastructure associated with a DPRK-linked hacking group. She described North Korean involvement as “very likely.”
Researchers have separately examined movements of the stolen XRP for potential connections with infrastructure associated with earlier attacks attributed to North Korea-linked operators.
Neither indicator establishes attribution by itself.
VPN infrastructure can be reused or deliberately selected to disguise an attacker’s identity, while blockchain links can establish movement between addresses without proving who controlled them.
Until Bitget releases its forensic findings or independent investigators provide stronger evidence, the DPRK connection remains an investigative assessment rather than a confirmed conclusion.
Bitget Says Its $464M Fund Can Cover the Loss
For customers, the immediate financial question is whether the breach will affect their balances.
Bitget says its User Protection Fund holds more than $464 million, exceeding the estimated $351.6 million affected by the attack. Chen has said customer assets remain backed and the exchange will absorb the loss.
Bitget’s cold wallets were not affected, according to the company.
READ MORE: Crypto Users Warned After FomoPeek iOS App Exposes Private Keys
Deposits and trading remained operational following the incident, while withdrawals were temporarily suspended as Bitget reviewed its wallet infrastructure.
The size of the protection fund addresses Bitget’s ability to absorb the financial impact. It does not answer the more important security question: how an attacker gained access to an internal system capable of producing unauthorized transfers.
A Separate NFT Scare Started With Zero-ETH Transfers
While investigators were following the assets stolen from Bitget, unusual activity appeared across hundreds of Ethereum wallets in a completely separate incident.
Initial alerts showed 3,832 NFTs worth more than $1.5 million moving from user wallets in transactions that appeared to value the assets at zero ETH.
No idea whats going on here but I just watched this wallet drain 3832 NFTs from 100s of different wallets
May be a good idea to revoke all NFT permissions if you have any valuables in your wallet
Seems to be funded from a wallet possibly linked to @0xQuit so maybe a whitehat? pic.twitter.com/semJYsjEXX
— Cirrus (@CirrusNFT) September 25, 2026
Because affected wallets had interacted with Magic Eden, early reports raised the possibility that the NFT marketplace had suffered an exploit.
That interpretation quickly changed.
Yuga Labs VP of Blockchain Quit, known as 0xQuit, said in X, that the transfers were part of an emergency white-hat operation. Vulnerable NFTs were being removed before a malicious attacker could take them.
As the rescue expanded, the total reached 23,155 NFTs worth more than $5.7 million.
Those NFTs were secured rather than stolen and are expected to be returned once the affected wallets are no longer exposed.
The Vulnerability Was Traced to Limit Break
Investigation subsequently shifted away from Magic Eden itself and toward Limit Break Payment Processor V2 on Ethereum.
The exposure involved smart-contract approvals previously granted by users.
NFT approvals allow an authorized operator to transfer assets without requiring the holder to manually approve every subsequent movement. Crucially, those permissions can remain active on-chain even after a user stops interacting with the marketplace or application through which the approval was originally granted.
Disconnecting a wallet from a website does not revoke that permission.
If an authorized contract later becomes vulnerable, an attacker may therefore be able to move assets without stealing the owner’s seed phrase or private key.
0xQuit also warned that Payment Processor V3 on ApeChain was affected by a similar issue. Users exposed to the relevant contracts were advised to revoke those approvals before rescued NFTs are returned.
About 660 WETH Was Not Recovered in Time
The vulnerability was not limited to NFTs.
0xQuit said the same issue could also be used to take WETH and reported that approximately 660 WETH was not secured in time during the white-hat operation.
That makes the distinction between exposed, rescued and stolen assets particularly important.
The 23,155 NFTs worth more than $5.7 million were rescued. That figure should not be treated as a $5.7 million loss.
The approximately 660 WETH, by contrast, represents assets that the white-hat operation reportedly failed to secure before they were moved.
Bitget vs. Limit Break: Two Different Security Failures
The two incidents show how crypto assets can become exposed even when the underlying private keys remain secure.
in affected assets
worth $5.7M+ rescued
The Private Keys Were Not the Weak Point
The comparison highlights an important security distinction.
In Bitget’s case, the exchange says its cryptographic keys remained secure while an attacker reached infrastructure trusted to generate or authorize transactions. The unanswered question is how that access was obtained.
In the NFT incident, users retained control of their wallets and keys. The exposure instead came from authority they had previously delegated to a smart contract.
The practical response is therefore different.
Bitget customers depend primarily on the exchange to investigate the intrusion, restore withdrawals and absorb the financial loss.
Bitget says its protection fund is sufficient to do so.
Users who interacted with the affected Limit Break contracts have something they can address directly: the outstanding approvals.
Those permissions need to be removed before rescued NFTs can safely return to the wallets from which they were taken.
Neither incident shows that private-key security has become irrelevant. Instead, both demonstrate that protecting the key is only one layer of crypto security.
A transaction can still become unauthorized from the user’s perspective when another trusted component retains legitimate authority to move the assets.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
