Beyond the heist ranking: What crypto thefts reveal about custody and customer protection

At 18:31 UTC on 24 September 2026, cryptocurrency exchange Bitget says its systems detected unauthorised transfers from some hot wallets. It suspended withdrawals, while deposits and trading remained available, and initially estimated that approximately $351.6 million had been affected.

A day later, the number changed. Bitget said about $387.5 million had been transferred to attacker-controlled addresses. According to the company, the higher figure included affected Zcash and TRON assets omitted from its first calculation. It did not represent another round of unauthorised transfers.

That revision is more than an accounting footnote. It illustrates the limits of ranking cryptocurrency thefts by a single headline number. Estimates evolve, token values depend on when they are measured, and incidents grouped under the broad label of a crypto hack may involve very different systems. Most importantly for customers, the amount transferred to an attacker does not by itself establish how much users will ultimately lose or when they will regain access to their money.

A ranking built from unlike events

Reuters placed Bitget alongside some of the largest cryptocurrency thefts it has documented, including Bybit, Poly Network, Ronin Network, Coincheck and Mt Gox. Such chronologies provide useful scale. Reuters also cited TRM Labs as estimating that attackers stole $2.9 billion across nearly 150 cryptocurrency attacks in 2025.

But the entries are not technically or financially interchangeable. Bitget said some hot wallets were affected. Reuters reported that Coincheck lost approximately $530 million in 2018 through an online hot wallet. By contrast, an earlier Reuters account said the $1.5 billion in ether stolen from Bybit in February 2025 was taken from a cold wallet. Mt Gox involved theft over several years, followed by bankruptcy and the loss of customer access to funds.

There is no single vulnerability connecting those cases in the supplied evidence. Comparing the affected layer is therefore more informative than treating every event as another example of the same technical failure.

Wallet labels are only a starting point

Hot, warm and cold describe different custody arrangements, but the labels do not provide a complete account of how transfers are authorised or how the surrounding controls work. Coincheck’s loss through an online hot wallet and Bitget’s account of compromised operational wallets fit a familiar category: assets used in active exchange operations were exposed to unauthorised movement.

Bitget said its cold wallets were unaffected. That distinction helps define the reported scope of the incident, but it remains a company claim rather than an independently verified finding. It also does not explain the precise weakness. The exchange said an underlying vulnerability allowed the attacker to bypass existing security controls, yet it had not disclosed the affected component, attack vector, credential path or other technical root cause by the evidence cutoff.

The Bybit case complicates any assumption that the word cold settles the security question. Reuters reported that the assets came from a cold wallet, and described the $1.5 billion theft as the largest cryptocurrency theft to date. Without a complete technical postmortem in the research packet, the comparison cannot establish how the Bitget and Bybit incidents occurred. It does show that a storage label alone says too little about the full authorisation and transaction process.

Attribution requires similar care. Reuters reported that the FBI attributed the separate Bybit theft to North Korea. No confirmed public threat-actor attribution for Bitget had been established in the reviewed authoritative sources. Treating the Bybit attribution as evidence about Bitget would conflate two distinct incidents.

The figures do not share one yardstick

The historical comparisons broaden further with Poly Network and Ronin Network. Reuters reported that approximately $610 million was stolen from Poly Network in August 2021. Nearly all of it was later returned. It also reported that Ronin Network lost about $540 million, valued at the time, in March 2022, comprising roughly 173,600 ether and 25.5 million USD Coin.

These examples remain useful measures of scale, but the supplied summaries do not establish a common security weakness or custody model across them and exchange wallet thefts. A concise chronology can group them usefully without proving technical equivalence or equal consequences for users.

The figures also need their valuation context. Reuters tied Ronin’s total to its value at the time of the incident. Bitget revised its estimate after identifying assets on additional networks. Successive heist lists can therefore change because investigators refine the scope, because asset prices move, or because reports use different valuation points. The research packet does not provide a standardised calculation that would make every historical figure directly comparable.

Stolen value is not the customer outcome

The sharpest differences emerge after the transfer. Poly Network’s near-total return is one outcome. Mt Gox represents another. Reuters reported that bitcoin worth close to $500 million was stolen from Mt Gox between 2011 and 2014. The exchange filed for bankruptcy, and approximately 24,000 customers lost access to funds.

Bitget has presented a third possible model. The company said customer balances remained accurate, user assets were protected and the loss would be covered by a User Protection Fund holding more than $464 million. It also said some affected assets had been frozen through coordination with industry partners and announced a recovery bounty equal to 5 per cent of funds successfully frozen or recovered through eligible contributions.

Those statements may eventually prove important to the customer outcome, but they were not independently verified at the evidence cutoff. Bitget had not disclosed a verified amount frozen or recovered, and no independent audit of the protection fund’s composition, liquidity or use was available. A fund’s stated size and a platform’s claim that it will absorb a loss are not the same as completed reimbursement or immediate access to assets.

Withdrawal availability is a separate measure again. Bitget said funds were protected while withdrawals remained suspended for security review. It promised a withdrawal-status announcement by 04:00 UTC on 26 September, but that update was still pending at the supplied cutoff of 00:32 UTC that day. Asset coverage, accurate account balances and the ability to withdraw should therefore be assessed as distinct questions, not collapsed into a single assurance that funds are safe.

Reading an incident notice for what it proves

Official notices are often the earliest source for detection times, service restrictions and changing estimates. Bitget’s notices documented the company’s account of when it detected the transfers, which services continued and why its estimate rose. They also disclosed that Mandiant and SlowMist were assisting with the investigation.

The same notices left major questions unanswered. Bitget said it had identified and remediated the vulnerability and that no further unauthorised transfers were possible. Neither security firm had published an independent report by the cutoff, however, and Bitget disclosed no software version, patch identifier or technical change. Its containment and remediation claims consequently remained attributed company statements, not independently validated conclusions.

For customers assessing such a notice, several distinctions reveal more than the headline total: which custody or infrastructure layer was affected, whether withdrawals function, how the loss was valued, how much has actually been frozen or returned, who is expected to absorb the remainder, and whether an independent postmortem supports the operator’s account. None of those checks guarantees a favourable outcome. Together, they show what is known and what still depends on trust in the platform.

Bitget’s $387.5 million estimate may earn the incident a place in future rankings. Its lasting significance will depend on evidence not yet available at the cutoff: the full attack path, independent validation of the fix, restored withdrawal access, the amount recovered and whether the protection fund performs as claimed. The number measures assets transferred. It does not yet measure the strength of the custody system that failed, the success of the response or the final cost to customers.

Understanding custody means looking past a wallet label to the wider authorisation and access process. In The Hack Academy’s online cybersecurity training programme, you can study cryptography, networking and cybersecurity fundamentals at your own pace, with practical exercises alongside theory.

Photo Credit: DepositPhotos.com