Hackers Took $351.6M From Bitget Without Stealing a Single Private Key. They Forged the Transfer Orders and Bitget's Own Signing Machines Approved Them

At 18:31 UTC on September 24, Bitget detected unauthorized transfers from its hot and warm wallets. The final count was $351.6 million, the biggest crypto hack of 2026 so far. The CEO says no private keys leaked. The attackers got into a third-party tool Bitget uses every day, forged transfer instructions, and let Bitget's own signing system approve them. It's the same basic approach as the $1.5B Bybit heist. Here's what was taken, where it went, and why it matters for anyone working in exchange security.