# The hot wallet moved

2026-09-25

Bitget says attackers took about $351.6 million from hot wallets at 18:31 UTC on 24 September. Customer keys and cold wallets were not the story they told. Lazarus is their label, not a published finding.

Canonical: https://www.fabiocti.com/notes/the-hot-wallet-moved/
Author: Fabio Correia

“Your balance is correct” and “you cannot withdraw” are both sentences they used.

Bitget says its systems caught unauthorized transfers from some hot wallets at 18:31 UTC on 24 September. About $351.6 million. Withdrawals were stopped. Deposits and trading stayed up. CEO Gracy Chen, on X and then in a live broadcast, said this was a breach of Bitget’s own systems: the attackers moved funds themselves, they did not forge customer withdrawal requests, they did not take users’ private keys, and cold wallets were not hit. She also said the initial picture included part of the warm-wallet layer.

The User Protection Fund was described as holding more than $464 million, enough on paper to cover the hole. Bitget has not said it has drawn the fund, how that number is marked, or whether a customer has to file anything. A written incident report was promised within 24 hours. It is not the thing that explains the door yet.

## What the Lazarus line is doing

Chen said she believes North Korea’s Lazarus group did it. No technical evidence for that has been published. She also said an insider is “quite low” and not ruled out, in a company of about 2,000 people. Her account of an older theft from a personal wallet is not evidence about this one.

Attribution is a press line until the report has a path. The operational facts that are actually on the record are narrower: hot-wallet transfers, withdrawals halted, customer keys claimed intact, cold storage claimed intact.

## If you hold a balance there

The question is not which group name sticks. It is whether the withdrawal halt is still the control that matters, and whether “the fund covers it” means the coins are back or means a promise that the liability is booked. Flagged destination addresses are not recovered funds. A balance that still displays is not a balance you can move.

I would not brief a board that Lazarus stole it. I would brief them that the hot wallet moved, the exit is shut, and the cause is still unpublished.