Crypto platform Bitget suspects North Korea is responsible for $352 million hack

Read, Watch or Listen

1x 1.5x 2x

Playback speed 1x 1.5x 2x

Cryptocurrency exchange Bitget confirmed an unauthorized outflow of assets totaling approximately $351.6 million following a security breach affecting portions of its hot and warm wallet infrastructure. The incident was detected on September 24, 2026, at 18:31 UTC when security systems identified unauthorized transfers involving several digital assets. Bitget Chief Executive Officer Gracy Chen stated during a live broadcast on X that preliminary findings suggest North Korean state-backed hackers, specifically the Lazarus Group, were behind the attack. According to the exchange, investigators traced suspicious IP addresses and virtual private network usage patterns that matched previous cyberattacks attributed to North Korean threat actors. Chen reported that the hackers breached a critical backend system of the wallet infrastructure rather than forging user withdrawal requests. The attackers manipulated transfer details internally to trigger regular signing processes. Bitget confirmed that its cold wallets remained completely secure and offline, and user private keys were not compromised. Among the affected digital assets, XRP accounted for the largest stolen volume, valued at nearly $157.5 million. Other impacted cryptocurrencies included Ethereum, BNB, USDT, and USDC. Following the detection of the breach, Bitget temporarily suspended platform withdrawals while leaving trading and deposits available. The exchange flagged the recipient wallet addresses, contacted law enforcement agencies, and coordinated with blockchain security firms and token foundations to freeze illicit funds. Bitget announced that the total stolen amount is fully covered by its User Protection Fund, which held more than $464 million at the time of the incident. The exchange stated that customer balances remain accurate and secure, while security teams continue a comprehensive forensic investigation into how the attackers gained initial entry into the internal backend systems.