Bitget Hack Losses Climb to $387.5 Million in North Korea-Linked Breach

Bitget’s losses from a backend breach of its wallet infrastructure have grown to $387.5 million, up from an initial confirmed figure of $351.6 million, as investigators continue tracing funds spread across at least five blockchains. The exchange and outside security firms attribute the attack to a hacking group linked to North Korea, marking what is believed to be the largest crypto exchange hack of 2026 and the latest sign that state-backed actors are finding new ways past exchange defenses.

The attack was detected on September 24, 2026 at 18:31 UTC. On-chain investigators had already tallied $183 million in suspicious outflows within about an hour, a pace that underscored how quickly funds can move once an attacker gains the right foothold inside an exchange’s systems. Bitget has said the intruder did not steal private keys or forge user withdrawal requests — the mechanism that has compromised other platforms in the past. Instead, the attacker breached a backend system and spoofed transaction data, tricking the exchange’s own authorization process into approving transfers it should have rejected. That distinction matters: it points to a weakness in internal verification logic rather than a leak of customer credentials or a compromised private key, which is a different and arguably harder problem to fully close off.

How the Theft Unfolded

Once inside, the attacker drained crypto from Bitget’s hot and warm wallets — the wallets exchanges keep more readily accessible to process everyday withdrawals — across multiple blockchains. The single largest asset taken was 103 million XRP, worth roughly $157 million, making it the biggest chunk of the total haul. In a separate and notably fast maneuver, the attacker used $19.67 million in USDT0 to purchase 7,111 ETH in just six minutes, paying roughly 5% above market price through UniswapX and 1inch Fusion. Overpaying to guarantee execution speed suggests the attacker prioritized quickly converting stolen assets into ether over squeezing out maximum value, a pattern consistent with actors trying to move funds before wallets can be flagged or frozen. Efforts to intercept the funds had limited success: Circle and Tether froze a hacker-controlled wallet but recovered only a small fraction of what had already moved through it, as previously reported in coverage of the attempt to freeze the Bitget hacker’s wallet.

Bitget responded by freezing withdrawals as a precaution while keeping deposits and trading running, a step meant to stop further outflows without shutting the platform down entirely. The exchange is working with blockchain forensics firm Mandiant and Chinese security firm SlowMist to investigate the breach and has pledged to publish a full incident report. CEO Gracy Chen has personal history with the suspected group as well: she has said she previously lost $80,000 to the same actors, a detail that adds a personal dimension to an exchange-wide crisis. Bitget maintains a User Protection Fund now exceeding $464 million, up from $300 million in 2023, which the exchange has pointed to as a backstop for affected users — though the fund’s growth also reflects how much larger the threat landscape has become since then.

A Pattern Bigger Than One Exchange

This breach does not exist in isolation. The FBI has already attributed North Korea’s Lazarus Group — also tracked under the name TraderTraitor — to the $1.4 billion theft from Bybit in February 2025, at the time the largest crypto exchange hack on record. Blockchain analytics firm Chainalysis has estimated North Korea’s total crypto theft haul for 2025 alone at more than $2 billion, a figure that reflects a sustained, organized campaign rather than opportunistic attacks. Coming so soon after the Bybit incident, the Bitget breach reinforces a picture of a well-resourced adversary that studies exchange infrastructure, adapts its methods, and treats crypto theft as a reliable source of revenue. For readers who track exchange security, the details of how the exploit worked — via spoofed backend authorization rather than a stolen key — were laid out in Bitget’s own account of the spoofed transfer mechanism behind the hack.

What Comes Next

Several threads remain open. Bitget’s promised incident report should clarify exactly which backend controls failed and what changes the exchange is making to its authorization pipeline. Investigators will continue tracking the stolen assets across the five-plus blockchains involved, including whether more of the funds routed through stablecoin issuers like Circle and Tether can be frozen before being laundered further. The episode has already made September the costliest month for crypto theft in 2026, a tally examined in earlier reporting on the scale of the Bitget hack, and that ranking could shift again if losses are revised upward once more, as they already have been once. Beyond Bitget, the incident is likely to renew scrutiny of how exchanges design internal transaction-approval systems industry-wide, since the flaw exploited here was not a user-facing weakness but an internal control that outsiders rarely get to examine until something goes wrong.

Source: Decrypt

This content is for informational purposes only and does not constitute financial or investment advice.