← Bitget Exchange — September 2026 Backend Hack ($387.5M)reviewed 2026-10-28 · 14 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Bitget Exchange — September 2026 Backend Hack ($387.5M) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in the timeline
“Mandiant's investigation finds the threat actor gained unauthorized privileged access to Bitget's third-party security appliances A and B and placed a web shell on Appliance B.”
reviewerMandiant found privileged access to Appliances A and B and a web shell on Appliance B, dated Sept 24Appliance A/B access is corroborated by The Hacker News. The exact Sept 24 date and web shell detail could not be read because BleepingComputer returned 403.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Zero-Day Root Cause and Attack Timeline
“SlowMist reported further suspicious activity on two other nodes on September 23 and September 25, including, on September 25, the attacker's use of an internal employee's identity to access a second product's management platform ("Product B")”
reviewerSlowMist reported suspicious activity on two other nodes on Sept 23 and Sept 25, including use of an employee identity to access Product BSource matches, but it states SlowMist's dates and times are UTC+8 while Bitget dates the theft Sept 24 UTC. The page does not explain the timezone difference, which is why it gives Sept 25 as the start of theft transfers. - #8[partially supported][awaiting moderator]in section: Suspected North Korean Attribution
“Bitget CEO Gracy Chen said she believed North Korean-linked hackers were "very likely" responsible for the attack, citing IP addresses associated with VPN services previously used by North Korean threat groups, behavioral patterns, and on-chain analysis”
reviewerChen said North Korea 'very likely' responsible citing IPs (VPN), behavior and on-chain dataCore attribution basis is supported. The VPN detail and exact quote were not visible in the fetched summary of The Record, so they are not independently confirmed. - #14[partially supported][awaiting moderator]in the timeline
“Attackers use a custom withdrawal tool to execute unauthorized transfers from Bitget's hot and warm wallets; the earliest verified theft transfer occurs at 02:31 UTC+8, with activity spanning roughly two to three hours. Bitget suspends withdrawals.”
reviewerTheft timeline entry dated 2026-09 with no day recorded, although the source gives Sept 25 (UTC+8)Content is supported. The timezone ambiguity (Sept 24 UTC against Sept 25 UTC+8) is not flagged in the entry. The 'two to three hours' span was not checked.
confirmed
10 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the timeline
“SlowMist later identifies this as the earliest logged malicious activity against a compromised third-party security appliance ("Product A").”
reviewerSlowMist traced earliest malicious activity to Aug 31, 2026 via a zero-day in a third-party productCointelegraph supports the Aug 31 date and zero-day. The 'Product A' labeling is consistent with other coverage. - #3[confirmed][no action needed]in section: Zero-Day Root Cause and Attack Timeline
“the earliest verified transfer recorded at 02:31 UTC+8”
reviewerEarliest verified theft transfer at 02:31 UTC+8 on Sept 25Confirmed. This equals Sept 24 UTC, consistent with Bitget's Sept 24 disclosure date. - #4[confirmed][no action needed]in section: Zero-Day Root Cause and Attack Timeline
“The attackers used a custom withdrawal tool, later recovered by SlowMist, to issue fraudulent withdrawal commands that bypassed Bitget's existing risk controls”
reviewerCustom withdrawal tool recovered by SlowMist used to issue fraudulent withdrawalsSupported. - #6[confirmed][no action needed]in section: Incident Overview and Financial Impact
“Bitget initially estimated the loss at approximately $351.6 million, later revising the figure upward to approximately $387.5 million”
reviewerLoss of $387.5M, revised from $351.6M; more than $175M left the platform on day oneRevision from $351.6M to $387.5M is consistent across the sources I read and in search results. - #7[confirmed][no action needed]in section: Incident Overview and Financial Impact
“CEO Gracy Chen said the exchange's User Protection Fund, which she described as holding over $464 million, would be used to cover user losses”
reviewerChen said User Protection Fund holds over $464M and compared the position to Bybit's $1.5B lossSupported by The Record. - #9[confirmed][no action needed]in section: Suspected North Korean Attribution
“Blockchain analytics firm Elliptic reported that funds stolen in the Bitget hack moved through addresses previously used to launder proceeds of the 2025 Bybit theft”
reviewerElliptic reported funds moved through addresses used to launder the 2025 Bybit theftCorroborated by search result excerpts. The Elliptic statement is not directly cited in this section's sources. - #10[confirmed][no action needed]in section: Suspected North Korean Attribution
“As of this writing, no government agency has issued a formal, independent attribution naming a specific North Korean unit in the Bitget case”
reviewerNo government agency has formally attributed the Bitget hackA negative claim. My search found no government attribution, which is consistent with the page. - #11[confirmed][no action needed]in section: Incident Overview and Financial Impact
“Bitget said on September 30 that the fund had been restored above $300 million, ahead of its stated one-week target”
reviewerWithdrawals resumed in phases; remaining services scheduled Oct 2 at 08:00 UTC; fund restored above $300M on Sept 30Fund and schedule are supported by search excerpts. I did not fetch this page to check the 'ahead of its stated target' detail. - #12[confirmed][no action needed]in section: Broader Context: DPRK Crypto Theft in 2026
“Reported frozen-fund totals also vary between sources, from roughly $503,000 (NEAR Intents alone) to figures approaching $1.1 million when combined with stablecoin-issuer freezes.”
reviewerFrozen funds ranged from about $503K (NEAR Intents) to about $1.1M combinedThe $1.1M combined figure is confirmed. The $503K NEAR figure is in the cited Defiant headline. - #13[confirmed][no action needed]in section: Zero-Day Root Cause and Attack Timeline
“Neither Bitget, SlowMist nor Mandiant has publicly named the vendors of the compromised security appliances”
reviewerVendors of the compromised appliances have not been namedSupported.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.