Bitget Reports $351.6M Hack by North Korea-Linked Actors
Cryptocurrency exchange suspends withdrawals after detecting unauthorized transfers.
1Massive crypto theft
Bitget detected unauthorized transfers totaling $351.6 million from hot and warm wallets on September 24, 2026. The exchange immediately suspended withdrawals and activated emergency protocols. The hack targeted multiple cryptocurrencies including ETH, XRP, BNB, AVAX, USDT and USDC across several blockchains. While customer balances and cold wallets remain secure, this represents one of the largest exchange breaches in recent years.
2Attack methodology
Hackers compromised a critical backend wallet system within Bitget's infrastructure, enabling them to spoof transaction data and bypass authorization processes. Security experts identified the attack patterns as consistent with known North Korean hacker organizations. The attackers' IP behavior and on-chain activity matched previous DPRK-linked operations. Bitget has contacted affected blockchain foundations, some of which have frozen identified hacker wallets.
3Ongoing investigation
Bitget has engaged cybersecurity firms Mandiant and SlowMist to conduct a full forensic investigation. The exchange's User Protection Fund will cover platform-wide impacts, though most assets remain secure. Deposits and trading continue normally despite withdrawal suspensions. The company maintains that Bitget Wallet, operating on separate infrastructure, was unaffected by the breach.
4North Korea's crypto heists
This incident follows a pattern of North Korea-linked cryptocurrency thefts, which totaled $2.02 billion in 2025 alone according to Chainalysis. DPRK-affiliated groups have stolen an estimated $6.75 billion in crypto assets to date. Their targets increasingly include exchanges and digital asset services, employing techniques ranging from sophisticated cyber intrusions to social engineering with fake IT worker identities.
5Exchange security implications
The breach highlights vulnerabilities in exchange wallet infrastructure, particularly in authorization systems for hot wallets. While cold storage remains secure, the compromise of backend systems enabling transaction spoofing represents an evolving threat vector. The incident may prompt exchanges to reevaluate their wallet architecture and transaction verification processes, especially for warm wallet solutions.
6Market impact
As one of the world's largest crypto exchanges serving 120 million users across 150 countries, Bitget's breach could temporarily shake investor confidence. However, the company's quick response and protection measures may mitigate long-term damage. The targeted cryptocurrencies may experience short-term volatility as the market digests the news of substantial outflows.
7Regulatory considerations
Major crypto heists often lead to increased regulatory scrutiny. This incident may accelerate calls for stricter security standards for exchanges, particularly regarding wallet management and transaction monitoring. The North Korean connection adds geopolitical dimensions that could influence international crypto regulations and sanctions enforcement.
8Broader security landscape
The Bitget hack demonstrates how state-affiliated groups continue to refine their attack methods against crypto platforms. As exchanges expand into traditional financial services, they become more attractive targets. This incident underscores the need for continuous security upgrades and threat intelligence sharing across the cryptocurrency ecosystem.
Original article: Security Affairs — Bitget Reports $351.6M Hack by North Korea-Linked Actors