A record quarter, an unresolved breach

Bitcoin is closing its strongest third quarter since 2017 at the same moment one of the sector’s largest exchanges is still tracing $387.5 million in stolen funds. The two stories are running in parallel this weekend, and the security failure is the one investors can’t yet close the book on.

Bitcoin traded at $84,626.50 as of early Sunday, up 0.84% on the day, according to Investing.com data. That puts the token up roughly 43.5% for the quarter, from about $58,500 at the start of July. The gain is Bitcoin’s best Q3 since 2017, when it rose about 80%, according to data cited by Bitcoin.com. Ether has climbed roughly 71% this quarter, its strongest Q3 on record.

Key Takeaways

  • Bitcoin traded at $84,626.50 as of Sunday, on pace for a 43.5% Q3 gain, its best since 2017.
  • Bitget’s hack tally rose from $351.6 million to a confirmed $387.5 million after attackers spoofed backend transfer data rather than stealing private keys, according to Startup Fortune.
  • Elliptic told Bloomberg the theft pushes suspected North Korea-linked crypto thefts past $1 billion for 2026, per Startup Fortune.
  • Bitget’s $464 million Protection Fund is held mostly in Bitcoin, meaning it only fully covers the loss if BTC stays above roughly $63,900, according to Memeburn.
  • Bitcoin withdrawals resume September 28, with Ether following September 29 and USDT on September 30, per Investing.com.

How the theft happened without a single stolen key

Bitget’s security systems flagged unauthorized transfers at 18:31 UTC on September 24, and the initial estimate of $351.6 million grew to $387.5 million after the exchange’s tracing team found additional Zcash and TRON assets moved in the same attack, according to Startup Fortune. CEO Gracy Chen said attackers compromised a backend system inside Bitget’s wallet infrastructure and used it to spoof transaction data, making fraudulent transfers look routine to the exchange’s own approval process. No private keys were stolen, and Bitget’s cold wallets, which hold the bulk of customer funds, were never touched.

The money moved fast once it was out. Attackers swapped 19.67 million USDT₀ for 7,111 ETH in about six minutes, paying up to 5% above market rate to complete the trade, according to blockchain analytics firm Arkham as cited by Startup Fortune. More than $170 million of the stolen funds was converted into ETH during the attack, a pattern researchers link to North Korean laundering operations that typically route funds through a peel chain of addresses before cashing out.

Chen said investigators found IP addresses matching VPN services tied to a DPRK-linked group, and some of the stolen funds were connected to addresses used in the $1.5 billion Bybit hack of February 2025, still the largest crypto theft on record. Elliptic told Bloomberg the Bitget theft pushes 2026’s total suspected North Korea-linked crypto thefts past $1 billion, a threshold that previously took the country a full year to reach.

Why XRP is the harder asset to claw back

CoinDesk reported that the attacker had moved roughly $83 million of stolen XRP out of three holding wallets by Saturday, with about $75 million still sitting in the original accounts. Exchanges can freeze accounts that receive illicit funds, but Ripple cannot freeze the native XRP token directly on its ledger, since the XRP Ledger’s freeze controls don’t apply to the native asset the way they do to issued tokens. That leaves recovery efforts dependent on exchange cooperation rather than a ledger-level freeze.

The Protection Fund’s Bitcoin exposure

Bitget says its User Protection Fund, which it puts at more than $464 million, will cover the full customer loss and that no account balances were altered, per Startup Fortune. That claim hasn’t been independently audited. Memeburn’s reporting adds a wrinkle: the fund is held mostly in Bitcoin, roughly 5,500 BTC, meaning its dollar value depends on where Bitcoin trades. At about 5,500 BTC, the fund covers this specific loss only if Bitcoin stays above roughly $63,900, a threshold Bitcoin sat well above as of Sunday but one that ties a security guarantee to a volatile asset.

Institutional push continues in parallel

The hack hasn’t slowed calls for deeper bank involvement in crypto. Strategy Chairman Michael Saylor urged U.S. banks to expand services including Bitcoin custody and loans collateralized by Bitcoin, and called on regulators to reconsider the 1,250% risk weighting applied to certain crypto holdings under international banking standards, arguing it restricts broader bank participation. He also said regulators should distinguish between banks holding Bitcoin for customers, lending against those assets, and taking positions with their own capital.

Bitcoin also cleared a large quarterly options expiry on Friday without significant price disruption, with spot trading volumes up and profit-taking relatively restrained heading into quarter-end, according to Investing.com.

What to Watch

Bitget’s phased withdrawal restart begins with Bitcoin on September 28, followed by Ether on September 29 and USDT on September 30. Whether the roughly $75 million in XRP still sitting in the attacker’s original wallets gets frozen or moves further will be a test of how much exchanges can contain a theft they can’t reverse on-chain. Mandiant and SlowMist remain involved in Bitget’s investigation, per Startup Fortune.

Sources