Bitget Says Suspected North Korean Hackers Drained $351.6M From Hot and Warm Wallets

At 18:31 UTC on September 24, 2026, security systems at the cryptocurrency exchange Bitget flagged unauthorized transfers out of a limited number of its hot wallets. By the time the company posted about it on X, it was describing a theft of $351.6 million from its hot and warm wallets, and pointing the finger at suspected North Korean threat actors.

Bitget said its cold wallets and the overwhelming majority of platform assets were unaffected. Customer account balances remain accurate, it said, and deposits and trading continued to operate normally. Withdrawals, however, were suspended as a precaution while what the company called a comprehensive security review gets under way. It also noted that Bitget Wallet, a self-custodial product, runs on completely separate infrastructure from the exchange and was not affected.

CEO Gracy Chen laid out more detail. The stolen assets include ETH, XRP, BNB, AVAX, USDT and USDC, moved across Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. According to Chen, the attacker compromised a critical backend system within the wallet infrastructure, used it to spoof transaction data, and thereby triggered the exchange's own authorization process to send funds out. She said no further unauthorized transfers are possible, though how the intruder got into the system is still under active investigation. Bitget has brought in Google-owned Mandiant and the firm SlowMist for an independent inquiry.

Chen said the attribution rests on IP behavior patterns and on-chain analysis, which she described as highly consistent with known North Korean groups. She added that the company has contacted the foundations of all affected chains, and some have confirmed freezing the hacker wallet addresses.

The figures moved after the first announcement. In a follow-up post, Bitget said assets worth approximately $390.06 million had gone to attacker-controlled addresses across multiple networks, citing its latest on-chain tracing and classification of transactions. It also launched a Recovery Bounty Program, calling on exchanges, blockchain projects, security researchers, investigators and the wider on-chain community to help freeze and recover the assets.

Outside analysts have added support to the attribution. Elliptic reported connections between XRP from the Bitget theft and ETH from an earlier exploit attributed to North Korea, as well as links between the stolen funds and addresses used to launder proceeds from previous attributed hacks, including the 2025 Bybit theft. Elliptic observed that shared laundering infrastructure is a recurring feature of such cases, with launderers favoring speed over operational discipline. TRM Labs found multiple overlaps with wallets used to launder earlier North Korean hacks, including Bybit and AFX Bridge, and said these point to the TraderTraitor group.

That group is best known for stealing $1.5 billion from Bybit and $292 million from KelpDAO's LayerZero bridge. About a week before the Bitget incident, SentinelOne attributed an attack on an India-based IT services company to TraderTraitor. If Bitget is confirmed as North Korean work, 2026 would reach $1.04 billion in North Korean crypto theft, making it the second-largest year on record behind 2025's $1.68 billion. Ari Redbord, TRM Labs' Global Head of Policy, said North Korea keeps stealing at alarming speed and scale, and argued the industry must harden its cyber controls while also going after the actors offensively.

On September 26, Bitget said the vulnerability used in the incident had been identified and addressed, and that withdrawals will resume in orderly phases beginning September 28 at 8 a.m. UTC. It reiterated that the incident is contained and user funds were unaffected. Recovery so far looks small: according to a Coindesk tracing dashboard, Circle and Tether have frozen stablecoins worth $339,100 tied to the hack. Watch for further freezes and for the findings from Mandiant and SlowMist.