Back Securityweek

North Korea Suspected in $351 Million Bitget Crypto Heist

Securityweek • September 25, 2026

Cryptocurrency exchange Bitget says the hackers who stole roughly $351.6 million in digital assets from its systems used techniques that closely resemble those of known North Korean threat actors.

“Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations,” Bitget CEO Gracy Chen said in a Friday post on X.

Chen’s post did not name a specific threat group, and Bitget has not detailed the evidence behind its assessment. She said the incident has been reported to the relevant authorities.

Founded in 2018, Bitget runs a centralized exchange for spot and derivatives crypto trading. It also offers Bitget Wallet, a self-custodial wallet that the company says runs on separate infrastructure and was not affected.

Bitget said its security systems caught the unauthorized transfers on September 24. The funds came from a small number of the exchange’s hot wallets. According to the company, its cold wallets were not touched.

The stolen funds include ETH, XRP, BNB, AVAX, USDT and USDC, spread across several blockchains. XRP accounts for the largest loss on a single chain. According to Chen, some blockchain foundations have frozen wallet addresses linked to the attacker.

The company hasn’t yet worked out how the attacker got in. However, it said the hacker compromised a critical backend system in its wallet infrastructure and abused it to get fraudulent transfers approved. Bitget said private keys were not compromised.

Mandiant and blockchain security firm SlowMist are helping with the investigation.

North Korean state- hackers have stolen billions of dollars’ worth of cryptocurrency in recent years. The FBI blamed North Korea for the February 2025 heist in which roughly $1.5 billion was stolen from Bybit.

Related : $290 Million Kelp DAO Crypto Heist Blamed on North Korea

Related : CryptoBandits Malware Doubles as a Backdoor, Abuses Tor

Related : Party’s Over for Crypto Scammers Who Went on a Spending Spree After a $240 Million Bitcoin Theft

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bitget Suffers $351.6 Million Hack Linked to North Korean Attackers On September 24, 2026, cryptocurrency exchange Bitget reported unauthorized transfers totaling approximately $351.6 million from its hot and warm wallets, attributed to suspected North Korean hackers. The breach was detected at 18:31 UTC and involved the compromise of a critical backend system, allowing attackers to spoof transaction data and trigger the exchange's authorization process. Bitget's cold wallets remained secure, and the incident is covered by its User Protection Fund, which holds over $464 million. CEO Gracy Chen indicated that the attack method aligns with known patterns of North Korean cyber operations. Withdrawals have been temporarily suspended while investigations are ongoing, and some blockchain foundations have already frozen the attackers' wallet addresses. The total loss estimate has since been revised to approximately $387.5 million as further assets were identified during on-chain tracing. 67 sources 78

Extracted Entities

North Korea Suspected in $351 Million Bitget Crypto Heist

The full story

Extracted Entities

Companies (1)

Countries (1)

Malware (1)