Bitget Says Suspected North Korean Hackers Stole Over $350 Million in Exchange Hack
Cryptocurrency exchange Bitget disclosed that it discovered unauthorized transfers from its hot and warm wallet systems on September 24, 2026, after attackers compromised a critical backend component of its wallet infrastructure. According to the company, the intruders used that access to spoof transaction data and trigger its internal authorization process, moving funds out to attacker-controlled addresses across seven blockchain networks. Bitget initially reported losses of $351.6 million, though the figure was later revised upward to roughly $390 million as investigators traced additional transfers involving ETH, XRP, BNB, AVAX, USDT, and USDC.
Bitget said the attack pattern was “highly consistent with known patterns of North Korean hacker organizations,” pointing to IP behavior and on-chain analysis, and attributed the intrusion to the TraderTraitor group. Blockchain analytics firms Elliptic and TRM Labs reported separately that they had traced links between the stolen funds and wallets tied to earlier North Korea-attributed thefts, including the roughly $1.5 billion Bybit heist in 2025 and the $292 million theft from KelpDAO’s LayerZero bridge. The incident also follows a separate report, published about a week earlier, attributing a breach at an India-based IT services firm to the same TraderTraitor group.
Bitget said its cold wallets and customer account balances were unaffected, and it patched the exploited vulnerability by September 26, confirming no further unauthorized transfers were possible. The exchange paused withdrawals as a precaution, brought in Google-owned Mandiant and blockchain security firm SlowMist to investigate, and launched a recovery bounty program to help track and claw back stolen assets; stablecoin issuers Circle and Tether froze a comparatively small portion of the funds, around $339,100. Bitget said it planned to resume withdrawals in phases starting September 28.
If the North Korean attribution holds, industry trackers note 2026 would become the second-largest year on record for North Korea-linked cryptocurrency theft, at roughly $1.04 billion, trailing only 2025’s $1.68 billion. Researchers have long linked such thefts to North Korean state efforts to fund its weapons and missile programs in the face of international sanctions.