The Bitget incident shows how a major cryptoasset compromise can become an international-security problem: testing operational resilience, exposing cross-border enforcement gaps and requiring rapid coordination between industry, investigators, law enforcement and policymakers.
By Edmonds Marshall McMahon (EMM)’s Digital Asset Team, Ashley Fairbrother, Nicola McKinney, Richard Doble, Rhys Evans, and Edis Balci
Background to the Bitget hack
On the evening of 24 September 2026, Bitget identified unauthorised transfers from elements of its wallet infrastructure, subsequently quantifying the affected amount at approximately US$351.6 million. The exchange suspended withdrawals, activated its incident-response procedures and engaged law-enforcement agencies and specialist on-chain investigators. Bitget has since stated that the loss is covered by its User Protection Fund, valued at more than US$464 million, and that the immediate threat has been contained. Its preliminary account is that no private key was compromised; rather, a critical backend system was infiltrated, enabling transaction data to be manipulated and the exchange’s authorisation process to be triggered. Those propositions remain subject to the promised technical report and independent verification.
The incident also provides a practical test of the institutional architecture for responding to illicit crypto-asset activity. Effective disruption depends not only on the technical ability to follow funds, but on whether exchanges, analytics firms, stablecoin issuers, law-enforcement agencies and courts can share reliable intelligence and act across borders at operational speed. The central policy question is therefore how to convert visible on-chain activity into coordinated and legally sustainable intervention.
The incident gives rise to a distinct set of questions for investigators, exchanges and recovery counsel: where are the misappropriated assets now; through which addresses, protocols and service providers have they moved; who exercises practical control over them; and what legal or operational measures remain available before the assets pass beyond an effective point of intervention? Those questions are analytically separate from whether Bitget has contained the intrusion or has sufficient resources to compensate customers. That distinction is central both to understanding the incident and to designing an effective response to a substantial digital-asset theft.
1. Containment, compensation and recovery are different things
Bitget’s public statements engage three separate, although related, strands of response: operational containment, financial protection and proprietary recovery. Operational containment concerns whether the compromised systems have been isolated and further unauthorised transfers prevented. Financial protection concerns whether the exchange can absorb the loss and meet customer claims, including through its User Protection Fund. Proprietary recovery concerns whether the transferred assets, or traceable substitutes, can be identified, preserved and restored to the person with the better proprietary claim. Success on one strand does not establish success on either of the others.
For customers and counterparties, the exchange’s operational status, liquidity position and timetable for restoring withdrawals will remain material. A sufficiently capitalised protection fund may reduce the incidence of direct customer loss, but it does not eliminate the risk of accelerated withdrawals, collateral demands, reduced market-maker activity or a broader loss of confidence. The immediate commercial question is therefore not confined to the nominal amount of the compromise; it extends to whether Bitget can demonstrate, with sufficient transparency, that its control environment has been remediated and that customer liabilities remain fully supportable.
2. The reported attack vector
Certain on-chain investigators have attributed the incident to the Lazarus Group and have suggested a connection with the July AFX compromise, in which approximately US$24 million was stolen and which was attributed to the activity cluster commonly described as TraderTraitor. If substantiated, that assessment would place the incident within a wider international-security concern: the use of cryptoasset theft by state-linked actors to generate and move value outside conventional financial channels.
Bitget’s preliminary technical account is that an attacker compromised a critical backend component within its wallet infrastructure, spoofed or altered transaction data and thereby caused the authorisation process to approve transfers that the legitimate operator had not intended. The exchange has said that compromise of the underlying private keys has been excluded, while acknowledging that the precise intrusion path remains under investigation and that a fuller report is expected within 24 hours. Pending that report, the material technical issues include the provenance and integrity of transaction instructions, the architecture of the approval workflow, the allocation of privileged access, the operation of any policy engine or signing service, and the extent to which independent verification controls existed between transaction creation and execution.
If that mechanism is confirmed, it would illustrate an important distinction between cryptographic custody and transaction-governance security. Protecting a private key against extraction is not equivalent to ensuring that the systems which formulate, validate and submit a transaction are themselves trustworthy. This can be contrasted with the recent Coldcard exploit, in relation to which EMM is instructed and is conducting investigations, and where it has already achieved recoveries: there, the alleged compromise concerned a different part of the custody and transaction chain. The legal and forensic analysis must therefore identify precisely which control failed, because that will inform questions of causation, responsibility, evidence preservation and the identity of potentially relevant third parties.
A wallet architecture may therefore employ robust key-generation, storage and signing controls while remaining vulnerable at the orchestration layer: for example, through corrupted transaction payloads, compromised application programming interfaces, excessive administrative privileges, deficient segregation of duties or a failure to reconcile the transaction displayed for approval with the transaction ultimately signed and broadcast. The critical enquiry is not merely whether a key was extracted, but whether the surrounding systems could be manipulated into presenting an unauthorised instruction as a valid transaction. Bitget’s present account suggests that the integrity of that authorisation chain may have failed. The entry point, any involvement of third-party systems and the complete sequence of events must await the technical evidence.
The resulting evidence will be relevant not only to remediation, but also to attribution and recovery. Preservation should extend to immutable transaction and signing logs; system and privileged-access records; approval histories; API calls; device and network telemetry; internal incident communications; wallet inventories; counterparty records; and material held by cloud, custody, software and other external providers. Preservation notices and disclosure strategy should be formulated at an early stage, because ordinary retention cycles, system remediation and the continuing movement of assets may otherwise degrade evidence central to later applications.
3. The first recovery window
The initial reports concerning Bitget described substantial transfers from wallets labelled as belonging to the exchange, followed by on-chain swaps and movements across blockchain networks.
The Block reported that more than $170 million had initially moved from Bitget-labelled wallets into an unidentified address. That early figure was subsequently overtaken by Bitget’s broader estimate of $351.6 million, reflecting the wider scope of the incident.
Digital assets can be transferred between addresses within seconds, exchanged into other tokens, bridged across networks, routed through decentralised protocols or deposited with service providers in multiple jurisdictions. The resulting recovery window is not defined solely by elapsed time. It depends on whether the assets encounter an actor capable of identifying a customer, preserving records, restricting an account, freezing a token or responding to compulsory process. Certain stablecoin issuers may have protocol-level or issuer-level freezing capabilities; native assets such as ETH generally do not provide an equivalent centralised control point. The practical response must therefore be asset-specific, chain-specific and jurisdiction-specific.
A useful recovery response therefore has to run on several tracks simultaneously.
The recovery sequence
- Identify and preserve
Confirm affected wallets, transactions, assets and timestamps. Preserve the available forensic and operational evidence.
- Trace the proceeds
Trace the assets across addresses, chains, exchanges, bridges and other services, maintaining a time-stamped record of the methodology, assumptions and confidence level attaching to each attribution. Public collaboration can materially accelerate that exercise: members of the digital-asset security community are undertaking tracing work, and Bybit has publicly offered assistance following Bitget’s support during the earlier Bybit incident. Any intelligence derived from open-source investigators should nevertheless be validated before it is relied upon for legal process.
- Identify the intervention points
Establish which exchanges, custodians, banks or other intermediaries may hold assets or relevant customer and transaction information.
- Secure urgent legal relief
Where the evidential and jurisdictional requirements are satisfied, disclosure, preservation, proprietary or freezing relief should be considered without avoidable delay. Bitget’s incorporation or operational base in Seychelles may complicate the availability and practical enforcement of urgent domestic relief there. English proceedings may nonetheless be relevant where there is a sufficient jurisdictional nexus, an arguable substantive claim and an applicable gateway for service out, particularly given the English court’s experience in granting worldwide freezing injunctions and proprietary relief in digital-asset cases. That observation should not be overstated: the existence of common-law traditions in other jurisdictions does not itself confer English jurisdiction, and the correct forum will depend on the location of assets and evidence, the identity and domicile of respondents, contractual provisions, governing law and the practical enforceability of any order.
- Pursue recovery
Use the resulting evidence to identify controllers, establish ownership and pursue the return of assets through the appropriate legal and cross-border processes.
Tracing, preservation and legal applications will frequently need to proceed in parallel. A claimant is rarely required to await a complete forensic reconstruction before seeking urgent relief, but it must place before the court evidence that is sufficiently reliable, candidly qualified and directed to the elements of the remedy sought. Delay can permit assets to be dissipated, mixed, bridged or converted; premature or overbroad applications can fail for want of jurisdiction, evidential foundation or proportionality. The operational objective is therefore to convert validated transaction evidence into a legally actionable opportunity at the earliest responsible point.
This sequence depends on institutions operating to compatible evidential and response standards. A tracing lead may lose operational value if an intermediary cannot receive an urgent notification, if information cannot lawfully be shared, if the relevant decision-maker is unavailable, or if legal process cannot be obtained or recognised quickly enough. Preparedness should therefore include tested contact channels, minimum evidential requirements, escalation protocols and mechanisms for lawful cross-border cooperation before an incident occurs.
4. Blockchain tracing must lead to a legally actionable intermediary
A public blockchain can provide a permanent record of transactions. But a wallet address is not, by itself, a person’s identity, a physical location or proof of who beneficially owns the assets.
The legal recovery opportunity often arises when the on-chain trail intersects with an identifiable organisation holding assets or information, such as decentralised exchanges, bridges, privacy protocols or multiple intermediary services.
A centralised exchange may hold customer identification records, account information, deposit and withdrawal histories, device data and internal transaction records. A custodian may hold assets. A bank may hold the fiat proceeds of a conversion.
The English courts have a unique and powerful set of legal remedies available to assist victims, including:
| Remedy | Potential purpose |
| Norwich Pharmacal relief | Obtain information from an appropriate third party involved in, or mixed up in, the relevant wrongdoing to identify wrongdoers or advance a claim. |
| Bankers Trust relief | Seek disclosure or assistance relating to the tracing and recovery of assets, where the applicable requirements are met. |
| Proprietary injunction | Protect assets claimed to belong beneficially to the applicant. |
| Freezing injunction | Restrain dealings with assets where the requirements for such relief are satisfied. |
These remedies are not automatic. The court will consider the evidence, the legal basis of the claim, the respondent’s role, jurisdiction, proportionality and the applicable procedural requirements.
Nor does the fact that an exchange has a UK-facing business or regulatory connection necessarily establish English jurisdiction over the relevant entity or assets. The correct respondent, the location of relevant assets or information, and the applicable jurisdictional gateway must be established on the facts.
Where assets or intermediaries are overseas, recovery may require coordinated applications and proceedings in multiple jurisdictions.
The practical point is that blockchain analysis, intelligence-sharing and legal strategy should be developed together. A technically accurate tracing report is most useful when it identifies a realistic intervention point, states the evidential basis and confidence level for that conclusion, and can be translated rapidly into a request that an intermediary, regulator, law-enforcement agency or court is able and authorised to act upon.
For an exchange or victim facing a major theft, that means involving legal advisers and forensic specialists early enough for the tracing work to inform urgent applications, rather than treating litigation as a later stage once the investigation has concluded.
5. What if the proceeds enter Monero or another privacy protocol?
The incident has also prompted speculation that part of the proceeds may have been converted into Monero (XMR), a privacy-focused cryptocurrency, against the background of an immediate increase in the market price of XMR. EMM has experience of matters in which assets were moved into XMR and, working with specialist investigators, has achieved recoveries notwithstanding the additional tracing difficulty. That experience supports a measured conclusion: conversion into a privacy asset may materially impair visibility, but it does not necessarily extinguish recovery prospects, particularly where evidence can be secured at the points of entry, conversion or exit.
The possibility is relevant both to recovery strategy and to the assessment of how sophisticated actors may use privacy-enhancing technologies to frustrate detection and disruption. It must, however, be separated from what the transaction evidence proves. Reports of swaps, bridge activity and contemporaneous price movements may support lines of enquiry; they do not, without more, establish that a defined quantity of stolen value was converted into XMR, identify the purchaser or demonstrate that the market movement was caused by the attacker. Market inference, blockchain tracing and actor attribution are distinct evidential exercises, with different methodologies and levels of confidence.
Where proceeds are converted into a privacy-focused asset, the observable chain may become substantially less informative after the conversion event. The investigation should then place greater weight on the evidence surrounding that event: deposit and withdrawal records, account identifiers, IP and device data, transaction timing, counterparties, bridge or swap-provider records and any identifiable exit point into a centralised service or fiat system. Even where later transfers cannot be followed with the same confidence, the pre-conversion trail may identify an intermediary from whom information or assets can be obtained. The evidential discipline remains the same: preserve the available data, distinguish attribution from hypothesis and avoid presenting an unverified inference as fact.
Conclusion
The incident raises a wider governance issue for exchanges and custodians. If the reported authorisation-layer compromise is confirmed, assurance frameworks will need to address not only the custody and use of private keys, but also the integrity of the data, systems and human approvals that cause a transaction to be signed. That requires effective segregation of duties, independent transaction verification, constrained privileged access, anomaly detection, reconciliation between intended and executed transfers, and incident procedures capable of preserving evidence while compromised systems are isolated.
The Bitget investigation may provide important evidence on each of those issues. Until the technical findings are published and tested, however, the exchange’s preliminary account should not be conflated with an independently established conclusion. What is already clear is that a major exchange compromise is not merely a cybersecurity event or a balance-sheet loss. It is simultaneously an operational-resilience issue, an evidential exercise and a time-critical cross-border asset-recovery matter. The prospects of recovery will often depend on whether forensic analysis, intelligence-sharing and legal process are coordinated rapidly enough to identify a viable intervention point while assets or information remain within reach. Major exchanges should therefore maintain pre-arranged access to internal and external specialists – including incident responders, blockchain investigators and counsel capable of pursuing urgent relief – rather than assembling those capabilities only after a compromise has occurred.
If you have been affected by a cryptoasset theft or fraud, speed can be critical to the prospects of recovery. EMM’s specialist Digital Asset Team combines legal, investigative and asset recovery expertise to trace digital assets, identify potential intervention points and pursue urgent recovery measures in the UK and across jurisdictions.
To discuss a cryptoasset loss or potential recovery, contact our Digital Asset Team.
