Bitget Hack Steals $351.6 Million, North Korea Suspected

MW Contributor · 2026-09-27T00:12:43+08:00

Cryptocurrency exchange Bitget has disclosed that around US$351.6 million in digital assets were stolen after attackers compromised part of its wallet infrastructure, with the company saying the methods used were consistent with known North Korean hacking activity. The security incident was detected on 24 September 2026 after Bitget identified unauthorised transfers from a limited number of its hot and warm wallets. Bitget temporarily suspended withdrawals while it investigated the breach with law enforcement, blockchain security firms and cybersecurity specialists including Mandiant and SlowMist. Deposits and trading remained available. The incident affected several blockchain networks and cryptocurrencies. Bitget CEO Gracy Chen said the affected networks included Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base. Assets involved included ETH, XRP, BNB, AVAX, USDT and USDC, among other tokens. Bitget said the largest loss on a single blockchain involved XRP. The company initially estimated that approximately US$351.6 million in assets had been affected. Its cold wallets and most of the exchange's other assets were not compromised. Bitget also said its separate self-custodial Bitget Wallet was unaffected because it operates on infrastructure independent from the centralised Bitget Exchange. According to Chen, the attackers compromised a critical backend system within Bitget's wallet infrastructure. They were then able to spoof transaction information and trigger the exchange's authorisation process to transfer assets. The company said there was no indication that the attackers obtained its private keys. CoinDesk reported that the attack instead involved manipulated transaction data being passed through the wallet authorisation process. Bitget has not yet publicly detailed exactly how the attackers gained access to the backend system. The intrusion method remains under investigation. The exchange has linked the attack to suspected North Korean hackers based on IP behaviour and blockchain analysis. Chen said the attack techniques were "highly consistent" with methods previously associated with North Korean hacking organisations. The attribution has not yet been independently confirmed by US authorities. Bitget said it had reported the incident to relevant organisations and was cooperating with a global investigation. North Korean state-linked hacking groups have a long history of targeting cryptocurrency exchanges and other digital asset companies. In February 2025, the FBI attributed the theft of approximately US$1.5 billion in cryptocurrency from Bybit to North Korea. The agency tracks that activity under the name TraderTraitor. Blockchain analysis company Chainalysis estimated that North Korean hackers stole approximately US$1.34 billion across 47 cryptocurrency attacks in 2024. That represented about 61% of the total value stolen from crypto platforms during that year. Elliptic has estimated that North Korean cyber groups have stolen more than US$6 billion in cryptocurrency since 2017. Bitget says losses from its latest breach are covered by its User Protection Fund. At the time of the initial disclosure, the fund held around 5,500 BTC valued at more than US$464 million. The exchange said customer account balances remained accurate despite the theft. Some of the stolen stablecoins have also been frozen. Circle and Tether blacklisted funds held in one wallet linked to the Bitget attackers, freezing approximately US$318,000 in USDT and USDC. However, that represents only a small proportion of the overall amount stolen. Bitget has since identified and fixed the vulnerability involved in the attack and is carrying out additional checks on its withdrawal infrastructure with Mandiant and SlowMist. The exchange now plans to restore withdrawals in stages. Bitcoin withdrawals are scheduled to resume at 08:00 UTC on 28 September, followed by ETH withdrawals on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism on 29 September. USDT withdrawals on Ethereum, BNB Smart Chain, Solana and Tron are scheduled for 30 September, while withdrawals involving other cryptocurrencies, fiat services and peer-to-peer services are expected to return from 2 October. Bitget said the schedule will apply equally to all users and that no further unauthorised transfers are possible following the security changes. The company has also promised to publish a full incident report containing its root-cause analysis and corrective actions after withdrawal services have been restored.

This topic has 0 replies, 1 voice, and was last updated 3 minutes ago by MW Contributor.

Viewing 1 post (of 1 total)

Posts

September 27, 2026 at 12:12 am
MW Contributor
Moderator
insert_chart
Cryptocurrency exchange Bitget has disclosed that around US$351.6 million in digital assets were stolen after attackers compromised part of its wallet infrastructure, with the company saying the methods used were consistent with known North Korean hacking activity.
The security incident was detected on 24 September 2026 after Bitget identified unauthorised transfers from a limited number of its hot and warm wallets.
Bitget temporarily suspended withdrawals while it investigated the breach with law enforcement, blockchain security firms and cybersecurity specialists including Mandiant and SlowMist. Deposits and trading remained available.
The incident affected several blockchain networks and cryptocurrencies.
Bitget CEO Gracy Chen said the affected networks included Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain and Base. Assets involved included ETH, XRP, BNB, AVAX, USDT and USDC, among other tokens.
Bitget said the largest loss on a single blockchain involved XRP.
The company initially estimated that approximately US$351.6 million in assets had been affected. Its cold wallets and most of the exchange’s other assets were not compromised.
Bitget also said its separate self-custodial Bitget Wallet was unaffected because it operates on infrastructure independent from the centralised Bitget Exchange.
According to Chen, the attackers compromised a critical backend system within Bitget’s wallet infrastructure. They were then able to spoof transaction information and trigger the exchange’s authorisation process to transfer assets.
The company said there was no indication that the attackers obtained its private keys. CoinDesk reported that the attack instead involved manipulated transaction data being passed through the wallet authorisation process.
Bitget has not yet publicly detailed exactly how the attackers gained access to the backend system. The intrusion method remains under investigation.
The exchange has linked the attack to suspected North Korean hackers based on IP behaviour and blockchain analysis.
Chen said the attack techniques were “highly consistent” with methods previously associated with North Korean hacking organisations.
The attribution has not yet been independently confirmed by US authorities. Bitget said it had reported the incident to relevant organisations and was cooperating with a global investigation.
North Korean state-linked hacking groups have a long history of targeting cryptocurrency exchanges and other digital asset companies.
In February 2025, the FBI attributed the theft of approximately US$1.5 billion in cryptocurrency from Bybit to North Korea. The agency tracks that activity under the name TraderTraitor.
Blockchain analysis company Chainalysis estimated that North Korean hackers stole approximately US$1.34 billion across 47 cryptocurrency attacks in 2024. That represented about 61% of the total value stolen from crypto platforms during that year.
Elliptic has estimated that North Korean cyber groups have stolen more than US$6 billion in cryptocurrency since 2017.
Bitget says losses from its latest breach are covered by its User Protection Fund. At the time of the initial disclosure, the fund held around 5,500 BTC valued at more than US$464 million.
The exchange said customer account balances remained accurate despite the theft.
Some of the stolen stablecoins have also been frozen. Circle and Tether blacklisted funds held in one wallet linked to the Bitget attackers, freezing approximately US$318,000 in USDT and USDC. However, that represents only a small proportion of the overall amount stolen.
Bitget has since identified and fixed the vulnerability involved in the attack and is carrying out additional checks on its withdrawal infrastructure with Mandiant and SlowMist.
The exchange now plans to restore withdrawals in stages.
Bitcoin withdrawals are scheduled to resume at 08:00 UTC on 28 September, followed by ETH withdrawals on Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism on 29 September.
USDT withdrawals on Ethereum, BNB Smart Chain, Solana and Tron are scheduled for 30 September, while withdrawals involving other cryptocurrencies, fiat services and peer-to-peer services are expected to return from 2 October.
Bitget said the schedule will apply equally to all users and that no further unauthorised transfers are possible following the security changes.
The company has also promised to publish a full incident report containing its root-cause analysis and corrective actions after withdrawal services have been restored.
0