Summary
- Bitget suffered a $387.5M hack on September 24 leading to $463M customer outflows within one day.
- MetaMask disclosed a validator infrastructure incident prompting precautionary Ethereum staking exits with no wallet funds at risk.
- Stolen Bitget funds were traced into Bitcoin, THORChain and CoinJoin while only a small fraction has been frozen.
Hackers breached Bitget on September 24 2026. They stole $387.5 million. Customers pulled $463 million in the next 24 hours.
That marks the fastest outflow since the exchange launched. The breach showed clear gaps in controls. A MetaMask validator problem on September 30 added more stress.
Context
Crypto platforms keep getting hit with attacks. These drain user confidence and pull liquidity fast. The Bitget theft matches a wave of exploits that hit both centralized exchanges and DeFi protocols in 2026.
Total value locked in DeFi stays high. Insurance coverage still lags. Users moved funds out quickly once risks appeared.
Details
Hackers routed most of the $387.5 million through Bitcoin, THORChain, and CoinJoin mixers. Only about $840000 has been frozen. Recovery stays difficult.
"Only about $840000 of the stolen $387.5M has been publicly frozen."
, Bitget report
MetaMask reported no direct threat to user wallets. The firm exited affected Ethereum validators on September 30. Researchers estimate lost rewards near 0.36 ETH for those positions.
Bitget expects services to return by October 2. Fiat and peer-to-peer trading should resume then. Its protection fund now sits at half the original size.
Reaction
No verified social data is available for inclusion.
Customers withdrew $463 million on the first day. This set a record for single-day outflows at Bitget. MetaMask staking exits added pressure on DeFi without direct wallet losses.
Bitget plans to normalize operations by October 2. Remediation work continues. Observers will track further tracing of the stolen funds and any control upgrades at other platforms.