Bitget Confirms $351.6M Crypto Theft, Suspects North Korean Hackers

Cryptocurrency exchange Bitget announced on September 24, 2026, that unauthorized transfers totaling $351.6 million had been removed from its hot and warm wallet layers following a backend system compromise. The breach was detected at 18:31 UTC when Bitget's security systems flagged the unauthorized activity. The attackers exploited a compromised backend system to spoof transaction data and trigger the exchange's authorization process, enabling fund transfers without stealing private keys. Bitget immediately suspended withdrawals as a precautionary measure while maintaining normal deposit and trading operations.

Bitget confirmed that cold wallets—its offline storage vault—remained fully secure and unaffected by the attack. The exchange stated that customer account balances are accurate and that further unauthorized transfers have been prevented. CEO Gracy Chen disclosed that the stolen assets included ETH, XRP, BNB, AVAX, USDT, USDC and other tokens across multiple blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitget has contacted the foundations of affected blockchain networks, with some confirming the freezing of attacker-controlled wallet addresses.

Gracy Chen attributed the attack to patterns consistent with North Korean hacker organizations based on IP behavior analysis and on-chain analysis. No technical evidence supporting this attribution has been publicly released. The company has engaged third-party investigators including Google-owned Mandiant and SlowMist to assist in the investigation. Chen clarified that Bitget Wallet, the exchange's decentralized wallet product, operates on completely separate infrastructure and was not affected by the incident.

Bitget stated that its User Protection Fund, which holds more than $464 million, fully covers the $351.6 million loss. The exchange pledged to publish a complete incident report within 24 hours, including root cause analysis and corrective measures. Multiple technical teams are working on system remediation and security hardening, though no specific timeline for withdrawal resumption has been provided. The theft marks one of 2026's largest cryptocurrency thefts, pushing September's total reported crypto losses to approximately $684 million, making it the costliest month for crypto security losses in 2026 to date.