Bitget hack loses $387.5 million, North Korea suspected

Bitget confirmed that attackers siphoned roughly $387.5 million from its hot and warm wallets on September 24, 2026. The breach was carried out by spoofing internal transaction data, allowing the exchange’s own approval system to process fraudulent payouts.

How the attack unfolded

At 18:31 UTC the exchange’s security systems flagged unauthorized transfers out of several hot wallets. Within an hour, investigators recorded about $183 million moving to external addresses across multiple blockchains. By the time Bitget publicly disclosed the incident, the total loss had risen to $351.6 million and later to $387.5 million.

CEO Gracy Chen explained that the attackers did not obtain private keys or forge user withdrawal requests. Instead, they breached a backend component of Bitget’s wallet infrastructure and forged transaction metadata, tricking the system into approving the transfers.

Assets taken

• Approximately 103 million XRP (about $157 million)
• Ethereum (ETH) purchased with stolen USDT
• Stablecoins, including USDT
• Other crypto assets moved across at least five blockchains

Response and protection

Bitget halted the outflow and froze withdrawals while deposits and trading continued. The exchange’s User Protection Fund, now exceeding $464 million, will cover the full loss, ensuring customer balances remain intact.

Suspected attribution

Chen noted that IP addresses and on‑chain patterns resemble techniques previously linked to North Korean state‑affiliated hacking groups. She cautioned that the attribution is not yet confirmed and that law‑enforcement investigations are ongoing.

Next steps

Bitget plans to publish a detailed incident report after completing forensic analysis with partners Mandiant and SlowMist. Withdrawals are expected to resume after the exchange announces a remediation plan.