Bitget CEO Says North Korean Hackers Likely Behind $350 Million Theft

Bitget CEO Gracy Chen told users that a North Korean‑linked group is “very likely” responsible for the $350 million theft that hit the exchange on September 24, 2026. The breach affected the platform’s wallet infrastructure but did not involve private keys for hot, warm, or cold wallets.

Attribution to North Korea

During a live Q&A on X, Chen said the investigation identified IP addresses matching VPN usage by a DPRK‑associated group. She did not name the specific unit, but on‑chain analyst Specter linked the stolen XRP to the AFX Trade exploit, which was previously attributed to the Lazarus‑linked “TraderTraitor” group.

How the Attack Was Executed

According to Chen, attackers compromised a critical backend system within Bitget’s wallet infrastructure. They spoofed transaction data and triggered the platform’s authorization process to move funds, without obtaining private keys or forging user withdrawal requests.

Assets Stolen

Lookonchain’s analysis shows nine different assets were taken, with XRP comprising the largest portion—about 102.9 million tokens valued at roughly $157.5 million. The exchange’s total confirmed loss is about $350 million, double the initial on‑chain estimate of $176 million.

Protection Fund Coverage

Bitget’s User Protection Fund, now exceeding $464 million and holding roughly 5,500 BTC, is intended to cover user losses from hacks. The exchange says the fund fully covers the recent theft.

Impact on 2026 Crypto Hack Landscape

DefiLlama data ranks the Bitget incident as the largest crypto hack of 2026, accounting for roughly 16 % of the year’s total $2.2 billion loss across 281 incidents. The breach follows other major attacks linked to North Korean actors earlier in the year.

Next Steps

Chen pledged to release a full technical report once investigators confirm the intrusion details and forensic evidence supporting the North Korean attribution.