- Lead. Crypto exchange Bitget lost $387.5 million in the largest digital-asset heist of 2026 after attackers breached its hot and warm wallets on September 24 — spoofing internal transfer approvals rather than stealing private keys, a technique US officials have previously attributed to North Korean threat actors.
- Fact. CEO Gracy Chen said IP addresses linked to VPN services previously used by North Korean hacking groups were involved in the attack, and the pattern resembled earlier documented operations attributed to Pyongyang-linked units.
- Stake. Bitget’s User Protection Fund holds more than $464 million and will cover the full loss, meaning customer balances remain intact — but the attack brings total crypto theft in 2026 to more than $2.1 billion across 334 incidents, and raises fresh questions about hot-wallet architecture at centralised exchanges.
Bitget’s security systems detected unauthorised transfers at 18:31 UTC on September 24. The exchange suspended withdrawals within the hour and activated its emergency response procedures. By Friday the stolen total had been revised upward twice, eventually settling at $387.5 million after analysts at on-chain security firms traced outflows across multiple asset classes: the haul included XRP, Ethereum, and stablecoins, with Circle and Tether freezing approximately $318,000 in USDC and USDT associated with the attackers — a modest recovery against the total loss.
How the Attack Worked
Chen said during an X livestream on Friday that the attackers did not steal private keys but instead compromised backend systems used to process wallet transactions, making fraudulent withdrawals appear to Bitget’s approval infrastructure as legitimate transfers. The technique — sometimes described as an authorisation spoofing or “approval hijacking” attack — is more difficult to defend against than simple credential theft because it exploits the internal logic of transaction validation rather than the cryptographic security of the wallet itself. Chen said the IP infrastructure involved had “previously been used by the group” responsible for earlier North Korean-attributed exchange breaches, though she stopped short of making a definitive attribution pending the investigation.
Market Reaction and Industry Context
Bitcoin pulled back from a weekend high of $85,100 to trade around $83,890 on Monday, with the Bitget news adding to existing headwinds from elevated US Treasury yields at 5.17% and geopolitical uncertainty around the Iran situation. Bitcoin ETF inflows of $134 million on September 25 helped cushion the drop, reflecting the maturing of institutional interest in the asset class even as exchange-level security incidents remain a systemic risk. The Bitget loss surpasses the $243 million DMM Bitcoin hack in early 2026 to become the year’s largest single exchange breach. North Korean-linked groups, operating under the Lazarus Group umbrella, have been identified by US Treasury and UN reports as responsible for over $1 billion in crypto theft since 2020.
What Happens Next for Bitget Users
Bitget stated that withdrawals would resume gradually and that all customer balances remained accurate and fully backed. The exchange said it had notified law enforcement globally and was cooperating with authorities. Security firm Mandiant was subsequently reported to be assisting with the investigation alongside blockchain analytics firm SlowMist. The episode adds pressure on regulators in the US, EU, and Asia-Pacific to accelerate work on hot-wallet custody standards for centralised crypto exchanges — a gap that has persisted despite years of high-profile breaches dating back to Mt. Gox in 2014.