Bitget, one of the larger centralized cryptocurrency exchanges by trading volume, confirmed on September 24 and 25, 2026 that hackers moved roughly $351.6 million out of its wallet infrastructure in a coordinated backend attack. The exchange says it has preliminarily linked the intrusion to North Korean state-backed hacking groups, based on IP-address patterns and on-chain transaction analysis. It is the largest single crypto exchange breach reported so far this year and the latest data point in what analytics firms already describe as a record-setting run of North Korean crypto theft.
The incident matters beyond the dollar figure. According to Bitget CEO Gracy Chen, the attacker did not steal a private key in the conventional sense. Instead, the company says a backend system inside its wallet infrastructure was compromised and used to spoof transaction data, tricking Bitget’s own authorization process into approving transfers that should never have gone out. That distinction changes how the industry has to think about exchange security, since it shows that isolating private keys in cold storage does not eliminate the risk if the software deciding what to sign can itself be manipulated.
Bitget Confirms $351.6 Million Breach of Wallet Infrastructure
Bitget said its security systems flagged unauthorized transfers involving a limited number of hot wallets at 18:31 UTC on September 24, 2026, according to BleepingComputer. The exchange activated emergency-response procedures within minutes and began containing the transfers, then temporarily suspended customer withdrawals while it investigated. Reported figures for the loss range from roughly $350 million to $352 million depending on when outlets valued the stolen assets, but the exchange’s own number, cited across multiple outlets, is $351.6 million.
Bitget said its cold wallets, where the bulk of customer assets sit in offline storage, were never touched. The company also said the “overwhelming majority” of platform assets remained secure and that customer account balances stayed accurate throughout the incident, with deposits and trading continuing to operate normally even as withdrawals were paused. That framing puts Bitget in a similar position to other large exchanges that have suffered hot-wallet breaches: painful and expensive, but not existential, provided the exchange has the reserves to cover the gap.
Timeline: How the Bitget Hack Unfolded in Hours
The public record of the breach, pieced together from Bitget’s own statements and reporting by The Hacker News and BleepingComputer, moved fast. Detection, containment, a public technical explanation, and a preliminary attribution to North Korea all happened inside roughly 24 hours, a pace that has become fairly typical for major exchange breaches since the Bybit hack set the template in February 2025.
| Time (UTC) | Event |
|---|---|
| Sept. 24, 2026, 18:31 | Bitget detects unauthorized transfers from a limited number of hot wallets |
| Sept. 24, 2026, shortly after | Emergency-response procedures activated; investigation and containment begin |
| Sept. 24, 2026, evening | Bitget temporarily suspends customer withdrawals |
| Sept. 25, 2026, 00:43:40 | CEO Gracy Chen publishes a technical update describing a backend wallet-infrastructure compromise |
| Sept. 25, 2026 | Bitget says private-key compromise has been ruled out and no further unauthorized transfers are possible |
| Sept. 25, 2026 | Bitget attributes the attack pattern, on a preliminary basis, to North Korean hacker organizations |
| Sept. 25, 2026 | Reported loss settles at approximately $351.6 million; withdrawals restored cautiously |
Two things are worth flagging about that timeline. First, Bitget disclosed the incident and a technical explanation within hours rather than days, which stands in contrast to breaches at other companies that have sat on incident details for weeks. Second, the company has been careful, at least in its public language, to separate what it has confirmed from what it suspects. It has confirmed the mechanism of the fund movement. It has not confirmed the identity of the attacker with forensic certainty.
Inside the Breach: How Attackers Spoofed Transaction Data
Bitget’s explanation describes a control-plane failure rather than a straightforward theft of a private key. Chen said the attacker compromised a critical backend system inside Bitget’s wallet infrastructure, used it to spoof transaction data, and then triggered the exchange’s own authorization process to move funds out to attacker-controlled addresses. In plain terms, the software that is supposed to tell Bitget’s signing systems what a legitimate transaction looks like was fed false information, and the signing systems trusted it.
Why Cold Storage Wasn’t the Whole Answer
Exchanges typically run a three-tier wallet model: cold wallets held offline for the bulk of reserves, warm wallets with limited connectivity for liquidity management, and hot wallets that stay online to process withdrawals quickly. Bitget said the breach was confined to portions of the hot and warm layers, with cold storage untouched. That containment likely kept the loss from being far larger, but it also illustrates a point security researchers have made repeatedly since the Bybit incident: an exchange can do everything right with key custody and still be exposed if the systems that approve what gets signed can be manipulated. The specific entry point Bitget’s attacker used to reach that backend system has not been disclosed, and Bitget says the exact intrusion method remains under investigation.
Why Bitget Suspects North Korea Was Behind the Attack
Chen laid out Bitget’s preliminary attribution in public remarks over September 24 and 25. Speaking about the investigation, she said the company had traced infrastructure used in the attack back to patterns seen before.
“We’ve identified some IP addresses that match the VPN choices by a certain DPRK group.”
Gracy Chen, CEO of Bitget — CNBC
“The pattern looks very much like what the North Korean team did before.”
Gracy Chen, CEO of Bitget — CNBC
Chen expanded on the reasoning in a separate statement, tying the assessment to both network-level indicators and blockchain forensics rather than just one signal.
“Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations.”
Gracy Chen, CEO of Bitget — SecurityWeek
Bitget is not alone in leaning toward that conclusion. Blockchain analytics firm Elliptic reportedly assessed the attack as “highly likely” linked to North Korea, according to SecurityWeek’s reporting. Separately, blockchain intelligence firm Arkham Intelligence said it observed post-hack fund movements involving AVAX, BNB, ETH, and stablecoins from wallets tied to the breach, a pattern consistent with the rapid multi-chain dispersal tactics DPRK-linked operators have used in past thefts. None of this amounts to a courtroom-grade identification. It is a probabilistic assessment built from IP infrastructure, laundering behavior, and timing, the same categories of evidence that federal investigators used before formally attributing last year’s Bybit hack to North Korea.
Bitget’s Response: Withdrawals, Containment, and the Protection Fund
Bitget’s immediate priority after detection was stopping further outflows and reassuring customers that their balances were intact. Chen said the company had ruled out private-key compromise, confirmed that loss containment was complete, and stated that no further unauthorized transfers were possible.
“We have reported to relevant institutions and are fully cooperating in conducting a global investigation.”
Gracy Chen, CEO of Bitget — BleepingComputer
To cover the shortfall, Bitget pointed to a protection fund it holds in bitcoin, reportedly valued at approximately $464 million. On paper, that figure comfortably exceeds the reported $351.6 million loss, which is the main reason the exchange has been able to frame this as a contained incident rather than a solvency crisis. Whether that reserve figure holds up under stress, and whether the eventual, fully audited loss number matches the initial estimate, are both things that tend to get revised in the weeks after a breach like this one.
Market Reaction: BGB Token and Investor Confidence
Bitget’s native token, BGB, dropped roughly 3.3% following the disclosure, based on figures reported by The Hacker News. That is a notable but not catastrophic move for a token tied directly to an exchange that just disclosed a nine-figure theft, and it suggests the market largely read the situation the way Bitget framed it: a serious but contained hot-wallet incident rather than an existential threat to the platform. There is no evidence in current reporting of a broader, market-wide selloff in bitcoin or major altcoins tied to the Bitget news specifically. The reaction has been concentrated in BGB and in general sentiment around exchange custody risk, echoing the pattern seen after other centralized-exchange breaches where the damage stays largely ring-fenced around the affected platform’s own token and reputation.
How the Bitget Hack Compares to the Bybit Breach of 2025
The obvious comparison is Bybit, which suffered the largest crypto exchange hack on record in February 2025. The two incidents share an alleged North Korean fingerprint but differ meaningfully in scale and mechanism.
| Detail | Bybit (Feb. 2025) | Bitget (Sept. 2026) |
|---|---|---|
| Date | February 21, 2025 | September 24, 2026 |
| Reported loss | $1.46 billion (Bybit figure); ~$1.5 billion (FBI rounded) | $351.6 million |
| Assets involved | 401,347 ETH, 90,375 stETH, 15,000 cmETH, 8,000 mETH | Assets from hot and warm wallets; specific token breakdown not fully disclosed |
| Mechanism | Manipulation of a cold-wallet transfer and signing process | Backend system compromise that spoofed transaction data to trigger authorization |
| Attribution | FBI named the group “TraderTraitor,” linked to Lazarus Group | Bitget’s preliminary attribution based on IP and on-chain analysis; Elliptic called a North Korea link “highly likely” |
| Private keys compromised | Yes, transaction-signing process manipulated | Bitget says no, private keys were not compromised |
The FBI’s public service announcement on the Bybit case, filed under the case name TraderTraitor, said the stolen assets were rapidly converted into bitcoin and other virtual assets and dispersed across thousands of blockchain addresses, a laundering pattern that made recovery extremely difficult. Blockchain investigator ZachXBT was among the first to publicly link the Bybit attack to Lazarus Group on the same day it happened, a claim Elliptic and the FBI later corroborated. Whether the Bitget funds follow a similarly fast, fragmented laundering path will likely determine how much of the $351.6 million is ever recovered or frozen.
Bitget’s case is smaller in dollar terms, but the mechanism is arguably more concerning for the industry. Bybit’s breach exploited a signing and transfer process tied to a cold wallet, already a well-understood attack surface that exchanges have spent the past year hardening. Bitget’s incident, if the company’s own account holds up, shows attackers moving one layer deeper, into the backend logic that decides what a “legitimate” transaction even looks like before it reaches the signing step. For anyone tracking crypto custody risk alongside other breach disclosures, including the $320 million Liquid Network hack and the Coldcard hardware wallet flaw that drained $103 million earlier this year, the throughline is the same: the weak point keeps moving away from the private key itself and toward the surrounding software.
North Korea’s Crypto Theft Machine: The Numbers Behind Lazarus Group
Two of the industry’s most-cited blockchain analytics firms have already put a number on how much North Korea allegedly stole in 2025, before this year’s Bitget incident is even factored into next year’s tally. Chainalysis’s 2026 Crypto Crime Report said DPRK-linked hackers stole more than $2 billion in 2025. TRM Labs put the figure slightly lower, at $1.92 billion attributed to North Korea-linked actors, out of $2.87 billion in total crypto stolen by illicit actors that year, with the Bybit breach alone accounting for $1.46 billion of that total.
| Source | Period | North Korea-linked crypto theft |
|---|---|---|
| Chainalysis, 2026 Crypto Crime Report | 2025 | More than $2 billion |
| TRM Labs, 2026 Crypto Crime Report | 2025 | $1.92 billion (of $2.87B total illicit crypto theft) |
| TRM Labs / Bybit-specific | Feb. 2025 | $1.46 billion (single incident) |
| Bitget (unconfirmed North Korea link) | Sept. 2026 | $351.6 million (pending formal attribution) |
The discrepancy between Chainalysis’s and TRM Labs’s 2025 totals, a gap of roughly $80 million, is not explained in either firm’s public summary, and the two organizations may be using different methodologies for what counts as confirmed DPRK attribution versus suspected attribution. Neither firm has published a confirmed 2026 year-to-date total for North Korea-linked crypto theft as of this writing, so it would be inaccurate to say the Bitget loss has already been added to an official running total. What is fair to say is that if Bitget’s preliminary attribution holds up under further investigation, the incident would rank among the larger DPRK-linked exchange thefts disclosed so far in 2026.
That steady drumbeat of theft has real-world consequences beyond exchange balance sheets. U.S. authorities have previously moved to freeze crypto tied to North Korean laundering networks, including the case against Xinbi Guarantee, where regulators froze $52 million in assets tied to sanctioned activity. Stolen exchange funds and sanctioned laundering networks increasingly look like two ends of the same pipeline.
Bitget by the Numbers: Company Background
Bitget was founded in 2018 and is registered in the Seychelles, according to both CoinMarketCap and CoinGecko listings. CoinMarketCap has described the exchange as serving more than 150 million users, though that figure’s exact date and methodology, whether it reflects registered accounts, verified accounts, or active users across Bitget’s broader product suite, is not independently detailed in the listing. CoinGecko recorded Bitget’s 24-hour trading volume at just under $1 billion at one recent snapshot, a figure that fluctuates daily and should be read as a point-in-time indicator rather than a fixed annual metric. Those numbers place Bitget among the more heavily used centralized exchanges globally, which is part of why a nine-figure breach at the platform drew immediate coverage from outlets that don’t typically cover mid-tier exchanges.
Historical Context: A Decade of DPRK Crypto Heists
North Korean state-linked hacking units, commonly grouped under the Lazarus Group umbrella in security reporting, have targeted banks, exchanges, DeFi protocols, and individual crypto holders for close to a decade. The pattern has evolved but the goal has stayed constant: generate hard currency for a sanctioned regime. Early operations focused on direct theft from centralized exchanges. Over time, the playbook expanded to include attacks on blockchain bridges, phishing and fake-job social-engineering campaigns aimed at developers and exchange employees, and increasingly sophisticated laundering chains that move stolen funds through mixers, cross-chain swaps, and thousands of intermediate wallets within hours of a theft.
The Bybit hack in February 2025 was the clearest demonstration yet of how far that capability has scaled, both in dollar terms and in the sophistication of the underlying exploit. The Bitget incident, smaller in dollar terms, extends the pattern into a new technical layer: the backend systems that generate and validate transaction data before it ever reaches a signing process. If Bitget’s account is accurate, it suggests DPRK-linked operators, or actors mimicking their techniques closely enough to fool blockchain forensics, are actively probing the control-plane software that sits around key custody rather than only attacking the keys themselves.
Regulatory and Law Enforcement Response
As of this writing, no U.S. or international regulator or law enforcement agency has issued a public statement specifically addressing the Bitget breach. That is not unusual this early in an incident. It took the FBI roughly a week after the Bybit hack to issue its formal public service announcement naming TraderTraitor and Lazarus Group, after blockchain investigators had already made the same connection independently. Bitget has said it reported the incident to “relevant institutions” and is cooperating with what it describes as a global investigation, though it has not named which specific agencies or jurisdictions are involved.
Given the scale of DPRK-linked crypto theft tallied by Chainalysis and TRM Labs for 2025 alone, this incident is likely to draw scrutiny from agencies focused on sanctions enforcement and virtual-asset money laundering, even without a confirmed government attribution yet. The regulatory aftermath of major breaches tends to unfold on a much longer timeline than the technical response, often stretching into settlements or enforcement actions that surface a year or more after the initial disclosure.
What This Means for Exchange Security Architecture
The security lesson exchanges are likely to take from this incident is uncomfortable: cold storage protects keys, not necessarily the systems that decide what gets signed. If a backend service can spoof the data that an authorization workflow trusts, then even an exchange with flawless key-custody hygiene can lose hundreds of millions of dollars. That has pushed some security researchers to argue exchanges need independent transaction verification, essentially a second system that reconstructs and checks what a transfer should look like rather than trusting the payload the primary backend hands it, as a baseline control rather than an optional upgrade.
It also raises a harder question about how the industry talks about security. “Keys never touched” has become a reassuring line exchanges reach for after a breach, and it is technically true in cases like this one. But it can obscure the fact that a backend compromise sophisticated enough to spoof an authorization system is arguably a more dangerous class of vulnerability than a straightforward key leak, precisely because it defeats the control most exchanges have spent years hardening.
Predictions: Where Exchange Security Goes From Here
- More exchanges disclose backend/control-plane audits. Expect competitors to publicly announce third-party reviews of transaction-authorization pipelines, not just cold-wallet key management, within the next few months.
- Bitget’s final loss figure gets revised. Initial breach estimates at major exchanges have historically shifted, sometimes up and sometimes down, once full forensic accounting is complete; a revised number for Bitget within weeks would not be unusual.
- Formal attribution takes months, not days. Based on the Bybit precedent, a government-level attribution (if one comes) is unlikely before late 2026 or early 2027, even though Bitget’s own preliminary assessment has already pointed to North Korea.
- Insurance and reserve-fund disclosures become a bigger differentiator. Bitget’s ability to point to a roughly $464 million protection fund likely blunted panic; expect rival exchanges to publicize similar reserves more proactively.
- 2026’s DPRK theft total will likely exceed 2025’s once tallied. With Bitget added to whatever other incidents occur before year-end, next year’s Chainalysis and TRM Labs reports are positioned to show another year-over-year increase in North Korea-linked crypto theft.
Frequently Asked Questions
How much money did hackers steal from Bitget?
Bitget says approximately $351.6 million was taken from its hot and warm wallet infrastructure on September 24, 2026. Some outlets have cited figures between roughly $350 million and $352 million depending on when the stolen assets were valued.
Is North Korea confirmed to be behind the Bitget hack?
Not with full certainty. Bitget has said the attack pattern is highly consistent with known North Korean hacking groups, based on IP-address behavior and on-chain analysis, and blockchain analytics firm Elliptic reportedly called a North Korea link “highly likely.” No government agency has issued a formal, confirmed attribution as of this writing.
Were Bitget’s private keys stolen?
Bitget says no. The company’s account is that a backend system was compromised and used to spoof transaction data, tricking the exchange’s own authorization process into approving fraudulent transfers, rather than an attacker obtaining a private signing key directly.
Did Bitget’s cold wallets get hacked too?
No. Bitget said its cold wallets, which hold the bulk of reserves offline, were unaffected, and that the breach was limited to portions of the hot and warm wallet layers.
How does the Bitget hack compare to the Bybit hack?
Bybit’s February 2025 breach was far larger, at roughly $1.46 billion to $1.5 billion, and the FBI formally attributed it to a North Korea-linked group it named TraderTraitor. Bitget’s loss is smaller at $351.6 million, and its attribution to North Korea remains preliminary rather than confirmed by a government agency.
Will Bitget customers be reimbursed?
Bitget has pointed to a bitcoin-denominated protection fund it says is valued at roughly $464 million, which exceeds the reported loss. The company has said customer account balances remained accurate throughout the incident and that deposits and trading continued operating normally.
How much has North Korea stolen in crypto overall?
Chainalysis’s 2026 Crypto Crime Report says DPRK-linked hackers stole more than $2 billion in 2025 alone. TRM Labs put the 2025 figure at $1.92 billion. Neither firm has published a confirmed 2026 year-to-date total as of this writing.
What should crypto exchange users do after this news?
Security researchers generally recommend keeping only trading-active funds on any exchange, using hardware wallets or self-custody for long-term holdings, and watching for official communications directly from Bitget rather than third-party messages referencing the breach, since large disclosures like this one typically trigger a wave of phishing attempts targeting affected users.
Related
- Liquid Network Hack: $320M Drained, $47M Kept [2026]
- Coldcard RNG Bug Drains $103M in Bitcoin, 7,300 Wallets Hit [2026]
- US Sanctions Xinbi Guarantee, Freezes $52M in Crypto [2026]
- ShinyHunters Say They Hacked FBI, Hold 2-3TB Data [2026]
- Wisconsin Joins $2.3M Labcorp Settlement, 16,615 Hit [2026]
Related Coverage
- BYD Hack Finds No Password: 8.3% of Aussie Car Sales [2026]
- Wisconsin Joins $2.3M Labcorp Settlement, 16,615 Hit [2026]
- GoPhish Setup: Run a Phishing Simulation in 13 Steps [2026]
- Microsoft Defender for Endpoint Setup: 10 Steps [2026]
- Norton 360 for Gamers vs Bitdefender vs Malwarebytes: 3% FPS Gap [2026]
