# North Korean hackers steal $351M in largest crypto heist of 2026 Bitget exchange breach follows pattern of attacks funding Pyongyang's nuclear program - **Source:** [cybersecurity | TechCrunch](https://brifing.si/source/73fbb25c-5e90-44c9-9a24-7906dc3436cd) - **Published:** 2026-09-25 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/a205793c-2312-47ca-82c3-c200eda73aad ## Record-breaking crypto theft North Korean hackers stole $351 million from cryptocurrency exchange Bitget, marking the largest digital currency heist of 2026. The attack targeted Bitget's hot wallets - internet-connected storage for active trading. This surpasses September's $340 million hack where most funds were returned. Bitget has suspended withdrawals while investigating the breach, which follows a pattern of high-profile crypto attacks this year. ## Attack methodology The hackers gained unauthorized access to Bitget's hot wallets, transferring funds on Thursday. Hot wallets are more vulnerable than cold storage as they remain online for trading convenience. Bitget CEO Gracy Chen noted the attack's signature matches known North Korean tactics. These groups often target open-source software for mass hacks, with stolen funds allegedly supporting Pyongyang's nuclear ambitions. ## North Korea's crypto dominance Blockchain intelligence firm TRM Labs reports North Korea accounts for 75% of all crypto thefts in 2026. The regime has refined its hacking operations, targeting exchanges and decentralized finance platforms. Previous attacks show sophisticated social engineering combined with technical exploits. This systematic approach provides steady funding despite international sanctions on the isolated nation. ## Exchange response Bitget activated its $464 million user protection fund to cover losses, though withdrawal timelines remain unclear. The exchange confirmed the breach via X posts on Thursday and Friday. While hot wallets were compromised, cold storage funds appear secure. The company faces pressure to restore trust as customers await access to their accounts and remaining assets. ## Geopolitical funding pipeline Experts link North Korean hacker groups like Lazarus to crypto thefts funding weapons programs. The UN estimates these operations generate $2 billion annually for Pyongyang. Unlike traditional banking thefts, crypto provides pseudonymous cross-border transfers difficult to trace or recover. This attack's scale suggests continued refinement of money-laundering techniques through mixers and chain-hopping. ## Industry-wide vulnerability The Bitget breach continues 2026's trend of major exchange hacks, highlighting systemic security gaps. Many platforms maintain substantial hot wallet balances for liquidity despite risks. Regulatory pressure for faster transactions conflicts with security best practices. While some exchanges insure deposits, coverage often falls short of total assets at risk during peak trading. ## User protection challenges Bitget's protection fund covers this theft, but questions remain about smaller exchanges' safeguards. The crypto industry lacks standardized insurance or government backstops. Users ultimately bear risk, as terms often limit exchange liability. This incident may accelerate calls for mandatory cold storage percentages or real-time auditing of hot wallet balances. ## Security arms race The attack underscores the escalating battle between exchanges and state-sponsored hackers. North Korean groups continuously adapt to new defenses, forcing costly security upgrades. Some platforms now use AI monitoring and multi-party computation wallets. However, the technical complexity of crypto systems creates persistent attack surfaces that sophisticated actors exploit. ## Sources covering this story - https://techcrunch.com/2026/09/25/north-korean-hackers-suspected-in-351m-crypto-theft-the-largest-so-far-this-year/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._