Neither Code Nor Keys: Halborn and the $387M Bitget Hack

September 2026: Crypto’s Costliest Month on Record

September 2026 set a record the industry had hoped to avoid. Blockchain security firm PeckShield counted 55 significant incidents and about $766.5 million in losses for the month; CertiK, counting a little differently, logged 97 incidents and roughly $768.4 million. Either tally made it the worst month for crypto theft on record, and two events accounted for almost all of it. One was the roughly $320 million exploit of the Liquid Network on 6 September. The other, two and a half weeks later, defined the year.

On 24 September, attackers drained Bitget, one of the world’s largest centralized exchanges. The first public figure was about $351.6 million; forensic teams tracing the outflows soon revised it to roughly $387.5 million, with some estimates nudging $390 million. That made it the biggest single crypto theft of 2026 and among the ten largest ever recorded. With Bitcoin trading near $77,000 in late October after a 6 percent weekly slide, the dollar value barely shifted, because the thieves had already moved the money into assets they could launder.

What set Bitget apart from the exploits that usually top these lists was what did not happen. No smart contract was broken. No private key was stolen. No employee fat-fingered a malicious signature. And that is exactly why Halborn, the Miami security firm whose post-mortems have become the sector’s unofficial coroner reports, sat down to write it up. Its verdict, published in the firm’s Explained series, is the clearest account yet of an attack that broke neither the code nor the keys.

The Firm That Writes Crypto’s Autopsies

Halborn is not Bitget’s auditor, and it did not sign off on the exchange’s infrastructure. Its role here is the one it has quietly made its own: the forensic analyst who shows up after the breach and explains, in plain language, how the money left. The firm was founded in Miami in 2019 by Steven Walbroehl and Rob Behnke, bootstrapped for about three years, then raised a $90 million Series A from Summit Partners in July 2022. Jacques Boschung, formerly of Kudelski Security, took over as chief executive in 2024, with Behnke moving to executive chairman and Walbroehl staying on as chief technology officer.

Halborn built its reputation on offense: red-team exercises, penetration testing, and the kind of adversarial simulation that assumes attackers are already inside. It has counted Coinbase, Polygon, and the Solana Foundation among its clients, and its mission statement promises to find and fix vulnerabilities “at every stage of development.” But the work that travels furthest is the post-mortem. When a nine-figure hack lands, Halborn’s Explained write-up is often the first readable reconstruction the rest of the industry gets. The Bitget piece is a case study in why audits alone no longer map to where the money is actually lost.

The Explained series has become a fixture precisely because it is not marketing. Each entry walks through a named incident, often one Halborn had no commercial stake in, and lays out the kill chain step by step. That credibility is also commercial strategy: a firm that can convincingly dissect how the biggest exchanges and protocols were breached is a firm institutions call before they get breached. As Halborn has leaned into banks, tokenized-asset issuers, and other traditional-finance clients under Boschung, the autopsies double as the clearest possible pitch for why boardrooms should take Web3 security seriously.

The $387 Million Theft, in Numbers

Before the mechanics, the shape of it. Bitget detected the unauthorized transfers at about 18:31 UTC on 24 September, though investigators later found the attackers had first established a foothold inside its systems around 31 August, nearly four weeks earlier. The loot left the exchange’s hot and warm wallets, the online pools that hold operational liquidity, while cold storage, where most reserves sit offline, was never touched.

Two numbers in that table do most of the explaining. The first is the gap between $351.6 million and $387.5 million, which is not sloppiness but the signature of a fast launderer: by the time Bitget published its initial figure, the attackers were already fanning funds across chains, and tracing firms kept finding more. The second is the $339,100 that issuers managed to freeze, a rounding error against the total, and the clearest sign of how little of this kind of theft is ever clawed back.

Neither Code Nor Keys: How the Money Left

Here is the part that makes the Bitget hack unusual, and the reason Halborn bothered to write about an exchange it never audited. In most large thefts, the attacker either finds a bug in a smart contract or gets hold of the private keys that authorize transfers. Bitget’s attackers did neither. They went after the layer in between: the backend system that assembles a transaction before it is signed.

Halborn put it bluntly: “Instead of trying to steal the private keys used to digitally sign blockchain transactions, the Lazarus Group exploited the wallet infrastructure that managed unsigned transactions.” In other words, the attackers did not forge a signature. They forged the instruction that Bitget’s own systems then signed, legitimately, with real keys, and pushed through a real approval process. The signing machinery worked perfectly. It just signed the wrong thing.

It helps to understand what an unsigned transaction is. Every blockchain transfer begins life as a set of instructions, pay this amount, to this address, from this wallet, that only becomes valid once a private key signs it. At a large exchange, that assembly happens automatically, deep in the backend, long before any key is involved; the signing step at the end is often the most heavily guarded part of the stack. By corrupting the instructions while they were still unsigned, the attackers let Bitget’s own trusted, well-protected signing process bless a payment to a destination it should never have approved. The guards were all watching the vault door while the paperwork was being forged in the back office.

Bitget’s chief executive, Gracy Chen, described the same sequence from the inside: “The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.” Read that twice. The exchange’s authorization process did fire. Controls that exist precisely to stop unauthorized withdrawals approved these withdrawals, because as far as the system could tell, they were routine. This is why no audit of the smart contracts and no amount of hardware key custody would have stopped it. The failure was upstream of both.

The Zero-Day Hiding in a Security Product

So how did attackers reach a system trusted enough to move hundreds of millions of dollars? Through software that was supposed to be part of the defense. In a statement posted after its investigation, Bitget said it had “identified malicious activity involving third-party security products, including a zero-day vulnerability, and recovered a customized tool used by the attacker to initiate unauthorized withdrawals.” Security firm SlowMist, assisting the response, narrowed it further: “A service running on one of Product A’s nodes was affected by a zero-day vulnerability.”

The irony is hard to miss. The component the attackers turned into a doorway was a security product. That is the defining feature of a supply-chain attack: rather than breaching the target directly, the intruder compromises a trusted vendor, library, or tool that the target has already waved through its perimeter. A zero-day, a flaw the vendor does not yet know about and has no patch for, gave the attackers a way in that no firewall was watching. From there they harvested high-level network credentials and built a custom tool to drive Bitget’s withdrawal pipeline.

If this sounds familiar, it should. The largest crypto theft ever, the $1.5 billion Bybit hack of February 2025, worked on the same principle. There, North Korea’s operators compromised a developer machine connected to Safe{Wallet} and injected malicious code into the signing interface, so the human approvers saw a benign transaction while the logic underneath redirected the funds. The FBI attributed Bybit to the DPRK group it tracks as TraderTraitor. In both cases the keys were never the weak point; the presentation and the plumbing around them were. It is the same lesson running through crypto’s October 2026 wallet wave, where the thefts that worked did not crack a single key, they fooled the systems and people around it.

A Timeline of the Breach

The public story compressed a slow intrusion into a single bad day, but the forensics tell a longer one. The attackers were patient, and the sources that reconstructed the event do not agree on every minute, so the timeline below reconciles the main accounts rather than picking one.

The month between the first foothold and the drain matters more than the drain itself. It is the window in which a well-resourced attacker learns how an exchange actually moves money: which systems talk to which, which approvals are automated, and where a forged instruction will be mistaken for a real one. By the time funds started leaving, the hard part was done. The withdrawals themselves were almost anticlimactic, which is the point.

The dating is worth a caveat. Bitget flagged the unauthorized transfers on 24 September, but some reconstructions place the decisive drain in the small hours of the 25th, a discrepancy that comes down to time zones and to the difference between when money started moving and when the exchange confirmed what it was seeing. None of it changes the shape of the event: a long, quiet intrusion followed by a short, loud theft.

Hot, Warm, and Cold: Why the Bleeding Stopped

Bitget survived losing nearly $390 million for one structural reason: the attackers could only reach the wallets that were online. Exchanges split custody into tiers. Cold wallets keep the bulk of customer assets offline, disconnected from any system an intruder can reach over the network, and signed only through deliberate, often physical, procedures. Hot wallets hold the smaller float needed to process live withdrawals. Warm wallets sit in between, topping up the hot tier on a schedule.

Because the compromise lived in the backend that services the online tiers, it drained the hot and warm pools but could not touch cold storage. That segmentation is the difference between an expensive, survivable incident and an extinction event. It is also why the single most important question to ask any custodian, centralized or not, is not “have you been audited” but “what is the blast radius if your most trusted internal system is turned against you.” At Bitget, the blast radius was the online float, and a protection fund large enough to cover it.

The tiered model is standard across the major exchanges, and the Bitget hack is a reminder of why it exists. Keeping the vast majority of assets in cold storage is not a convenience, it is the assumption that the online systems will eventually be compromised, and the plan for when they are. The firms that survive large breaches tend to be the ones that treated their own operational infrastructure as hostile territory long before an attacker proved them right.

Why an Audit Would Not Have Saved Bitget

The uncomfortable truth the Bitget hack drives home is that the security product the industry sells most, the smart-contract audit, would not have caught this. An audit reviews code: the logic of the contracts that live on-chain. Bitget’s contracts were never the problem. The hole was in operational infrastructure, in a third-party tool, in the signing pipeline, in the human and machine workflows that an audit’s scope explicitly excludes.

Two structural limits make this inevitable. An audit is a snapshot in time, a review of a specific version of the code over a few weeks, and it says nothing about the infrastructure that will run that code in production months later. Its scope is deliberately narrow, usually the on-chain contracts and little else, so the servers that build transactions, the admin accounts that can pause or upgrade a system, the third-party tools bolted onto the stack, and the staff who operate all of it fall outside the engagement by design. A clean report means the code examined behaved as written. It is silent on everything the examiners were never asked to look at.

Ronghui Gu, co-founder of audit firm CertiK, has put the point about as plainly as anyone in the industry: a protocol “can pass a flawless code audit and still lose millions because of a compromised admin key,” he told Forbes. The data backs him up. TRM Labs found that in the first half of 2026, infrastructure and operational attacks were only about 15 percent of incidents but accounted for roughly 76 percent of the value stolen. Code bugs are the most common vector. They are no longer the most costly one.

This is the thesis Halborn keeps returning to in its 2026 write-ups, and it reframes what an audit is for. A clean audit report is a necessary hygiene check, not a certificate of safety. The attackers who matter most, state-backed groups with months to spend and a budget to burn, have already concluded that the cheapest way into a well-defended target is not the code. It is the key management, the admin access, the vendor software, and the people. Securing the contract while leaving that surface exposed is like fitting a bank vault with a flawless lock and leaving the loading dock open.

The Halborn Casebook: 2026 in Autopsies

Bitget did not happen in isolation. It is the latest entry in a casebook Halborn has been building all year, and read together, the entries make the argument better than any single incident can. Nearly every nine-figure loss of 2026 came from somewhere other than the application code.

The outlier is instructive. Of the two giant September hacks, only the Liquid Network exploit was a genuine code bug, a flaw in the Elements rangeproof logic that underpins the Bitcoin sidechain. Bitget, the larger of the two, touched no application code at all. The rest of the casebook rhymes: Drift, a Solana perpetuals exchange, fell to a durable-nonce governance trick and a fake collateral token, not a contract flaw; its attackers quietly disarmed the protocol’s security council, a governance-capture pattern that also haunts on-chain voting in gaming DAOs. Kelp DAO lost $292 million to a misconfigured bridge verifier. Humanity Protocol lost keys stored on a laptop. The consistent message: the attack surface has moved off the chain and onto everything around it.

Taken as a set, the casebook is an argument against a comforting story the industry likes to tell itself, that a project with enough audits is safe. Audits remain worth doing; they catch the common, cheaper failures. But the pattern of 2026 is that the expensive failures live elsewhere, and a reader scanning that table for a single reassuring column, the one marked application code at fault, will find mostly the word no.

Follow the Money: Laundering and the Freeze

Stealing the money is half the job; keeping it is the other half, and here the attackers moved with the speed that marks a professional operation. On-chain investigators at Global Ledger traced the aftermath: by 25 September, roughly $184 million sat as ETH across nine attacker-controlled wallets (about 68,465 ETH), and some $154 million as XRP across six accounts (about 98.34 million XRP), with smaller amounts swapped into Bitcoin. The choice of assets is deliberate. Native coins like ETH and XRP cannot be frozen by any central party; stablecoins can.

That distinction is the whole game once funds are moving. Stablecoin issuers can blacklist an address and burn or immobilize the tokens inside it, which makes a frozen USDT balance the closest thing crypto has to a kill switch. Tether chief executive Paolo Ardoino has made the posture explicit: “USDT is not a safe haven for illicit activity. When credible links to sanctioned entities or criminal networks are identified, we act immediately and decisively,” he said when announcing a $344 million freeze earlier in 2026. But a freeze only bites while the loot is still in a freezable asset. Bitget’s attackers knew that, which is why Circle and Tether together managed to lock down just about $339,100 before the rest was gone.

The laundering also explains why the dollar figure kept climbing in the days after the hack. As the attackers split funds across wallets and chains and swapped between assets, tracing firms kept attaching new addresses to the same cluster, which is how an initial $351.6 million estimate grew toward $390 million. For victims and investigators alike, the first 24 hours are the only window that reliably matters; after that, the money is spread thin, bridged across networks, and increasingly out of reach of any freeze.

The broader numbers are bleak. Across the first half of 2026, forensic firm Global Ledger found that only about 7 percent of hack incidents saw any funds recovered, and barely a tenth of stolen value was clawed back or frozen. Large exchange and bridge thefts fare worst of all, often returning well under 1 percent, while the small, sloppy hacks are the ones that get reversed. Bitget’s $339,100 freeze against a $387.5 million loss sits right on that curve. The lesson the figures keep teaching is that prevention is the only strategy that reliably works, because recovery, for a theft this size and this attacker, almost never does.

The North Korea Problem

Every serious analysis of the Bitget hack reaches the same destination. Bitget suspected North Korea within a day, and blockchain forensics firms, Elliptic, TRM Labs, and Chainalysis among them, converged on the same attribution, citing laundering patterns and wallet links that overlapped with the 2025 Bybit theft and with the earlier AFX Bridge hack. With Bitget on the board, Chainalysis calculated that North Korea’s attributed crypto haul for 2026 had crossed $1 billion.

What has changed is not that North Korea steals crypto, it is how. The Lazarus playbook in 2026 leans on long, patient human operations as much as on technical exploits. Ari Redbord, global head of policy at TRM Labs, described the newer approach to CoinDesk as “North Korean proxies sitting across a table from protocol employees over a period of months,” adding that the operations are “no longer just a remote keyboard operation.” Fake job interviews, infiltrated contractor roles, and months of reconnaissance now precede the exploit. The same AI wave reshaping the rest of crypto, from autonomous on-chain trading agents to defensive tooling, is also arming attackers with faster, more convincing social engineering.

The human layer has become a program in its own right. North Korea now runs thousands of operatives who pose as remote IT contractors, passing interviews with forged resumes and deepfaked video calls to land jobs inside crypto firms, where they either siphon salaries back to Pyongyang or open a door for the exploit team. Investigators have traced networks of laptop farms inside the United States that let these workers appear to log in from domestic addresses. For an exchange, it means the threat is not only a flaw in a vendor’s software; it can be a colleague on the payroll, which is exactly why Halborn frames modern defense as assume-breach rather than keep-out.

The attribution matters for a practical reason: it determines whether the money can ever come back. A conventional thief can sometimes be negotiated with, offered a bounty to return most of the funds and keep a slice. A sanctioned, state-backed group cannot be paid at all without breaking the law, which closes off the one informal recovery path that occasionally works. When the attacker is Lazarus, the realistic recovery rate is close to zero, and the heavy lifting falls not to the SEC but to the agencies with the right tools: the FBI, which attributes and pursues; the Department of Justice, which seizes; and the Treasury’s OFAC, whose sanctions give a stablecoin freeze its legal teeth.

Users Made Whole, Trust Dented

For all the size of the theft, Bitget’s customers did not lose their money, and that is the part of the story most likely to shape how exchanges are judged. The exchange said its User Protection Fund, a reserve it set up in 2022 and had grown to more than $464 million, fully covered the loss. It paused withdrawals, then reopened them in stages: Bitcoin on 28 September, Ethereum on the 29th, USDT on the 30th, and everything else, including fiat, by 2 October. Bitget also offered a recovery bounty, 5 percent of any funds that assistance helped freeze or recover.

A backstop is not the same as being unharmed, though. In the days after the hack, users pulled roughly $463 million in net outflows, and the protection fund that absorbed the theft was reported to have been cut to a fraction of its former size before Bitget committed to replenishing it. The episode revived the oldest argument in crypto custody. Centralized exchanges offer convenience and, in Bitget’s case, a balance sheet big enough to eat a $390 million loss; what they ask in return is that you trust their internal systems, the very systems the attackers turned.

For most users, the honest takeaway is not a slogan but a question of trust modeling. An exchange like Bitget can make you whole after a catastrophe because it is large and well capitalized; a smaller venue hit for the same proportion of its reserves might simply fail. Self-custody removes that counterparty risk and replaces it with your own operational security, which, as the Humanity Protocol laptop and the Coldcard key failures in Halborn’s casebook show, is its own minefield. There is no option that outsources the problem entirely; there is only choosing which risks you would rather own.

What Changes After Bitget: Securing the Pipeline

Halborn’s prescription follows directly from its diagnosis. If the weakness is the infrastructure that surrounds the keys rather than the keys themselves, then that infrastructure has to be tested the way an attacker would test it. The firm’s write-up argues that the incident “demonstrates the importance of securing every element of a Web3 organization’s infrastructure,” and points to its Custody and Key Management Assessments as the service aimed squarely at transaction-signing workflows. In practice that means segmenting internal networks so a single compromised node cannot reach the withdrawal pipeline, monitoring the construction of unsigned transactions for anomalies, treating every third-party tool as a potential entry point, and running assume-breach red-team exercises instead of relying on point-in-time reviews.

Regulation lags all of this, especially in the United States. No US rule requires an exchange to stress-test its signing infrastructure or accredits anyone to do the testing. The SEC’s cyber-disclosure rules compel a public company to report a material incident within four business days of deciding it is material, but that is a duty to disclose, not to defend. Under chair Paul Atkins, the agency’s crypto agenda, laid out in its Project Crypto framework, has focused on how tokens are classified, not on how custodians secure their plumbing. In the absence of a mandate, the quality of an exchange’s internal security is policed by reputation and by the market’s memory of the last breach.

The contrast with Europe is sharp. The EU’s Digital Operational Resilience Act, binding on crypto-asset service providers since early 2025, targets exactly the failure mode that sank Bitget: it requires firms to manage information-and-communication-technology third-party risk and, for significant entities, to run threat-led penetration tests on live systems. A tool like the one that opened Bitget’s door is precisely what DORA’s third-party-risk pillar is written to surface. Whether that difference produces safer exchanges or just more paperwork is the open question, but the direction of travel is clear: the industry is being pushed, slowly, to secure the whole machine rather than just the code it runs.

Frequently Asked Questions

How much was stolen in the Bitget hack?

Attackers drained Bitget on 24 September 2026. The loss was first reported at about $351.6 million and later revised by forensic firms to roughly $387.5 million, making it the largest crypto theft of 2026 and one of the ten biggest on record. Bitget said its User Protection Fund fully covered the loss, so customers did not lose funds.

How did the Bitget hackers steal the money without stealing private keys?

The attackers exploited a zero-day in a third-party security product to gain high-level access, then spoofed transaction data inside Bitget’s backend wallet infrastructure. Bitget’s own authorization process signed and approved the forged withdrawals as if they were routine, so no private keys were stolen and no smart contract was broken.

Who was behind the Bitget hack?

Blockchain forensics firms including Elliptic, TRM Labs, and Chainalysis attributed the theft to North Korea’s Lazarus Group, citing laundering patterns and wallet links shared with the 2025 Bybit hack. The incident pushed North Korea’s attributed crypto haul for 2026 past $1 billion.

Did Bitget users lose their money?

No. Bitget said its User Protection Fund, grown to more than $464 million, fully covered the stolen amount, and it reopened withdrawals in stages between 28 September and 2 October. The exchange did see heavy net outflows in the following days as nervous users moved funds elsewhere.

Would a smart contract audit have prevented the Bitget hack?

No. An audit reviews on-chain contract code, and Bitget’s contracts were not the weak point; the attack hit operational infrastructure and a third-party tool that sit outside an audit’s scope. Security firm Halborn uses the case to argue that custody, key management, and signing workflows now need the same scrutiny as code.

Anneke de Vries covers security and exploits for HOGE Wire.