Cryptocurrency exchange Bitget has confirmed that hackers stole roughly $351.6 million from the platform in an attack the company first detected on September 24, 2026. Bitget says the intrusion shows patterns consistent with previous hacks attributed to North Korea, though it has not named a specific group behind the theft.
According to Bitget CEO Gracy Chen, the attackers did not steal any private keys or break into the exchange’s cold storage. Instead, they compromised a backend system inside Bitget’s wallet infrastructure and used it to spoof transaction data, tricking the exchange’s own authorization process into approving fraudulent withdrawals. The stolen funds came from Bitget’s “hot” and “warm” wallets, the pools of cryptocurrency that exchanges keep more readily accessible for daily trading and withdrawals, as opposed to “cold” wallets that are kept offline and are much harder for an outside attacker to reach.
The stolen assets spanned several major cryptocurrencies, including ether (ETH), XRP, BNB, AVAX, and the stablecoins USDT and USDC, spread across seven different blockchain networks: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain, and Base. Some reporting on the incident puts the final tally closer to $390 million once follow-on transfers were accounted for.
Bitget said its self-custodial Bitget Wallet product, which runs on separate infrastructure from the exchange itself, was not affected. The company temporarily suspended withdrawals while it investigated, brought in incident response firm Mandiant and blockchain security company SlowMist, and reported the theft to law enforcement. Stablecoin issuers Circle and Tether managed to freeze a small portion of the stolen funds, worth about $339,100, before the money could be moved further. Bitget has said it will use its User Protection Fund, which it states holds around $464 million in bitcoin, to make affected customers whole, and it began restoring withdrawals in phases starting September 28.
On the question of who is responsible, Bitget has been cautious. Chen said the attack’s characteristics, including IP behavior patterns and the on-chain movement of the stolen funds, are “highly consistent with known patterns of North Korean hacker organizations,” but the company stopped short of naming a specific unit such as Lazarus or TraderTraitor. Some outlets covering the story have pointed to overlaps with laundering infrastructure used in earlier thefts attributed to North Korean operators, including the Bybit hack and the LayerZero bridge exploit tied to KelpDAO, though these specific connections have not been independently confirmed by outside investigators as of publication.
If the North Korean attribution holds up, the Bitget theft would add to what has already been a costly year for crypto platforms. Researchers tracking these incidents estimate that North Korean-linked hacking groups have stolen over $1 billion from cryptocurrency services in 2026 alone, making it the second largest year on record for this kind of theft, behind only 2025.
No CVE has been assigned to this incident, since it involved a compromise of Bitget’s internal backend systems rather than a specific disclosed software vulnerability. Bitget has said the underlying issue that allowed the spoofed authorization has since been identified and fixed.
Source: The Hacker News, with additional reporting from BleepingComputer and SecurityWeek.
