# Bitget Reports $351.6M Hack by North Korea-Linked Actors Cryptocurrency exchange suspends withdrawals after detecting unauthorized transfers. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-25 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/c28ddd0e-04a6-42e9-9a7e-4eb5945f2c3e ## Massive crypto theft Bitget detected unauthorized transfers totaling $351.6 million from hot and warm wallets on September 24, 2026. The exchange immediately suspended withdrawals and activated emergency protocols. The hack targeted multiple cryptocurrencies including ETH, XRP, BNB, AVAX, USDT and USDC across several blockchains. While customer balances and cold wallets remain secure, this represents one of the largest exchange breaches in recent years. ## Attack methodology Hackers compromised a critical backend wallet system within Bitget's infrastructure, enabling them to spoof transaction data and bypass authorization processes. Security experts identified the attack patterns as consistent with known North Korean hacker organizations. The attackers' IP behavior and on-chain activity matched previous DPRK-linked operations. Bitget has contacted affected blockchain foundations, some of which have frozen identified hacker wallets. ## Ongoing investigation Bitget has engaged cybersecurity firms Mandiant and SlowMist to conduct a full forensic investigation. The exchange's User Protection Fund will cover platform-wide impacts, though most assets remain secure. Deposits and trading continue normally despite withdrawal suspensions. The company maintains that Bitget Wallet, operating on separate infrastructure, was unaffected by the breach. ## North Korea's crypto heists This incident follows a pattern of North Korea-linked cryptocurrency thefts, which totaled $2.02 billion in 2025 alone according to Chainalysis. DPRK-affiliated groups have stolen an estimated $6.75 billion in crypto assets to date. Their targets increasingly include exchanges and digital asset services, employing techniques ranging from sophisticated cyber intrusions to social engineering with fake IT worker identities. ## Exchange security implications The breach highlights vulnerabilities in exchange wallet infrastructure, particularly in authorization systems for hot wallets. While cold storage remains secure, the compromise of backend systems enabling transaction spoofing represents an evolving threat vector. The incident may prompt exchanges to reevaluate their wallet architecture and transaction verification processes, especially for warm wallet solutions. ## Market impact As one of the world's largest crypto exchanges serving 120 million users across 150 countries, Bitget's breach could temporarily shake investor confidence. However, the company's quick response and protection measures may mitigate long-term damage. The targeted cryptocurrencies may experience short-term volatility as the market digests the news of substantial outflows. ## Regulatory considerations Major crypto heists often lead to increased regulatory scrutiny. This incident may accelerate calls for stricter security standards for exchanges, particularly regarding wallet management and transaction monitoring. The North Korean connection adds geopolitical dimensions that could influence international crypto regulations and sanctions enforcement. ## Broader security landscape The Bitget hack demonstrates how state-affiliated groups continue to refine their attack methods against crypto platforms. As exchanges expand into traditional financial services, they become more attractive targets. This incident underscores the need for continuous security upgrades and threat intelligence sharing across the cryptocurrency ecosystem. ## Sources covering this story - https://securityaffairs.com/199754/cyber-crime/cryptocurrency-exchange-bitget-says-north-korea-linked-hackers-stole-351-6-million.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._