Bitget CEO Links $352M Hack to North Korean Hackers

ct.com

Bitget CEO Links $352M Hack to North Korean Hackers

First seen 25 Sep 2026, 10:53 UTC • •72.5

Article Content

1 / 4

Browse articles

ThreatCluster •September 25, 2026 at 12:25 UTC

•Bitget lost approximately $351.6 million in a security breach linked to North Korean hackers.
•Preliminary investigations identified IP addresses associated with North Korean VPN services.
•Withdrawals from Bitget have been suspended as investigations continue.

Bitget, a cryptocurrency exchange, experienced a security breach resulting in a loss of approximately $351.6 million. CEO Gracy Chen indicated that preliminary investigations revealed IP addresses associated with North Korean VPN services, suggesting state-sponsored involvement. The breach, which occurred on September 25, 2026, affected portions of Bitget's hot and warm wallet infrastructure, leading to the suspension of withdrawals. Investigators are still assessing the compromised systems and how the attackers gained access. Some stolen funds have reportedly been recovered, but specific amounts were not disclosed. The incident follows a pattern consistent with previous North Korean cyberattacks, including a major hack of the Bybit exchange in 2025. Bitget is collaborating with blockchain foundations for recovery efforts.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-25

Bitget reports $352M hack

Bitget confirmed unauthorized transfers affecting its hot and warm wallet infrastructure, leading to withdrawal suspensions.

2026-09-25

CEO links hack to North Korea

Gracy Chen stated that IP addresses matched those used by North Korean hackers, indicating a potential state-sponsored attack.

2026-09-25

Investigation ongoing

Bitget is working with investigators to determine how the attackers gained access and which systems were compromised.

More articles in this cluster (3)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Data Breach

Organization (3)

Bitget
Bybit
X

Malware (1)

AFX Exploiter

Relationships

AFX Exploiter targets Bitget
AFX Exploiter targets Bybit
AFX Exploiter targets X
AFX Exploiter related to Data Breach

Following this threat?

Track AFX Exploiter and Bitget in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Vulnerability in F5 BIG-IP APM Exploited for Remote Code Execution F5 Networks has reported a critical vulnerability in its BIG-IP Access Policy Manager (APM), tracked as CVE-2026-94127, which is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute remote code on systems configured with both an APM access policy and an OAuth profile. This…

Massive Network of AI Proxy Servers Used for Malicious Activities Uncovered Security researchers from Team Cymru have identified over 10,000 proxy servers in China facilitating malicious AI activities. These servers, termed 'transfer stations,' are primarily used to bypass geographic restrictions and conduct model distillation attacks against frontier AI models. The infrastructure allows…