Bitget Links North Korean Hackers to $352 Million Crypto Theft after investigators identified technical similarities between the exchange breach and previous attacks associated with the country’s cyber groups. The incident affected parts of Bitget’s hot and warm wallet infrastructure, prompting an immediate suspension of withdrawals while specialists traced funds and assessed the compromised systems.
- What Happened in the Bitget Crypto Hack?
- Why Bitget Suspects North Korean Hackers
- How the Bitget Attack Was Carried Out
- Were Bitget Customers’ Funds Affected?
- Why Bitget Suspended Withdrawals
- Has Bitget Recovered Any of the Stolen Funds?
- North Korea’s Suspected Role in Crypto Theft
- How This Attack Differs From a Typical Wallet Theft
- What Bitget Users Should Do Now
- Follow Official Announcements
- Avoid Fake Recovery Services
- Review Account Activity
- Strengthen Account Security
- Consider Personal Custody Risks
- What the Hack Means for Centralized Exchanges
- Frequently Asked Questions
- How much cryptocurrency was stolen from Bitget?
- Has North Korea been confirmed as responsible?
- Were Bitget’s cold wallets hacked?
- Did the hackers steal customers’ private keys?
- Will Bitget users lose their funds?
- Why were Bitget withdrawals suspended?
- Was the self-custodial Bitget Wallet affected?
- Can the stolen cryptocurrency be recovered?
- Conclusion
Bitget says cold wallets and most platform assets remained secure, while its protection fund can cover losses. However, official attribution remains preliminary as the investigation continues.
What Happened in the Bitget Crypto Hack?
Cryptocurrency exchange Bitget confirmed unauthorized transfers involving approximately $351.6 million in digital assets on September 24, 2026.
The company said its security systems detected suspicious transactions affecting a limited portion of its hot and warm wallet infrastructure. Bitget activated its emergency response procedures and temporarily suspended withdrawals while investigating the breach.
Deposits and trading reportedly continued operating. Bitget also stated that its cold wallets and most assets held by the platform were not affected.
The affected assets were reportedly distributed across several blockchain networks, including:
- Ethereum
- XRP Ledger
- BNB Smart Chain
- Arbitrum
- Avalanche
- Optimism
- Base
Tokens involved reportedly included Ether, XRP, BNB, AVAX, USDT, USDC, and other digital assets. XRP represented the largest single-chain loss, according to Bitget CEO Gracy Chen.
Read More: HBAR Price: Can Hedera Break Above $0.082 and Move Higher?
Why Bitget Suspects North Korean Hackers
Bitget has not presented its North Korea assessment as a final conclusion. The attribution is based on preliminary technical and blockchain evidence gathered during the investigation.
Chen said investigators identified internet protocol addresses associated with VPN services previously used by a suspected North Korean hacking group. Security specialists also found similarities between the attack method and patterns observed in earlier incidents attributed to North Korea-linked actors.
Key Attribution Indicators
The preliminary North Korea connection reportedly rests on several factors:
- IP addresses linked to familiar VPN usage patterns
- Similarities with previous North Korea-linked operations
- Movement of stolen assets across multiple blockchain networks
- Connections identified through on-chain transaction analysis
- A possible link between certain wallets and an earlier crypto exploit
An independent on-chain researcher reportedly traced some stolen XRP through wallet activity connected to an address associated with the previous AFX exploit. AFX had earlier suspected that North Korea-linked TraderTraitor hackers were involved in its July attack.
These findings may strengthen the working theory, but they do not yet constitute definitive public proof. Reliable attribution normally requires combined evidence from infrastructure records, malware analysis, blockchain tracing, access logs, intelligence sources, and law-enforcement investigations.
How the Bitget Attack Was Carried Out
Bitget’s preliminary investigation indicates that the attackers compromised a critical backend component within the exchange’s wallet infrastructure.
The hackers allegedly used that access to manipulate transfer information and activate Bitget’s transaction authorization process. This allowed funds to be moved directly from affected wallets.
According to the company, the attackers did not submit fraudulent customer withdrawal requests. Bitget also said they did not obtain private keys belonging to its cold, hot, or warm wallets.
This distinction is important because it suggests the incident may have exploited internal wallet operations or authorization controls rather than directly stealing the cryptographic keys protecting the wallets.
What Remains Unknown
Investigators were still working to determine:
- The initial method used to access Bitget’s systems
- Which backend components were compromised
- Whether stolen credentials or malware were involved
- How long the attackers maintained access
- Whether any third-party system contributed to the breach
- How the authorization controls were bypassed
- How much of the stolen cryptocurrency can be recovered
Bitget said the vulnerability had been contained and that no further unauthorized transfers were possible. However, a complete technical explanation will require a detailed post-incident investigation.
Were Bitget Customers’ Funds Affected?
Bitget said customer account balances remained accurate despite approximately $351.6 million in affected platform assets.
The exchange stated that the incident qualifies for coverage through its User Protection Fund. At the time of its announcement, the fund reportedly held approximately 5,500 Bitcoin, valued by Bitget at more than $464 million.
This means the reported value of the fund exceeded the estimated value of the affected assets at that time. However, cryptocurrency values can fluctuate, so the dollar value of a Bitcoin-based protection fund can change rapidly.
| Security area | Reported status |
|---|---|
| Hot wallets | Partially affected |
| Warm wallets | Partially affected |
| Cold wallets | Reported secure |
| Customer balances | Reported accurate |
| Deposits | Continued operating |
| Trading | Continued operating |
| Withdrawals | Temporarily suspended |
| Bitget Wallet | Reported unaffected |
| User Protection Fund | Expected to cover losses |
Bitget Wallet, the company’s self-custodial wallet product, was reportedly unaffected because it operates through separate infrastructure from the centralized Bitget Exchange.
Why Bitget Suspended Withdrawals
Temporarily suspending withdrawals is a common emergency measure following a centralized exchange breach.
The restriction prevents attackers from moving additional assets while security teams investigate the affected infrastructure. It also gives the exchange time to review wallet balances, replace compromised systems, examine pending transactions, and introduce additional safeguards.
Bitget said withdrawals would resume after investigators confirmed that the platform could safely return to normal operations.
Users should rely on Bitget’s official website and verified social-media accounts for withdrawal updates. Fraudsters frequently exploit major security incidents by creating fake support accounts, fraudulent reimbursement forms, and phishing websites.
Has Bitget Recovered Any of the Stolen Funds?
Chen said some stolen assets had been recovered, but the exchange did not initially disclose the value or exact tokens involved.
Bitget was working with blockchain foundations, security companies, law-enforcement agencies, and other industry partners to trace and potentially freeze funds.
Because cryptocurrency transactions are recorded on public blockchains, investigators can monitor the movement of stolen assets. Recovery may become possible when hackers transfer funds through centralized platforms, stablecoin issuers, bridges, or other services capable of freezing or restricting assets.
However, blockchain visibility does not guarantee recovery. Attackers can complicate tracing by:
- Dividing funds among hundreds of addresses
- Swapping tokens through decentralized exchanges
- Moving assets across multiple blockchains
- Using mixing or obfuscation services
- Converting traceable tokens into less restricted assets
- Waiting before attempting to launder the funds
North Korea’s Suspected Role in Crypto Theft
North Korea-linked hacking groups have repeatedly been accused of targeting cryptocurrency exchanges, blockchain companies, software developers, and individual investors.
These operations are commonly associated with groups identified by researchers and government agencies as Lazarus Group, TraderTraitor, and related units. Their techniques have included social engineering, malware, compromised software, fake employment opportunities, and manipulation of crypto transaction systems.
In February 2025, the FBI attributed the approximately $1.5 billion Bybit theft to North Korea-linked TraderTraitor actors. The attackers moved stolen assets through numerous blockchain addresses and converted portions into other cryptocurrencies.
North Korea has denied involvement in cyberattacks and cryptocurrency theft. Therefore, any connection to the Bitget incident should remain described as suspected unless confirmed by authoritative investigators.
How This Attack Differs From a Typical Wallet Theft
Not every crypto hack uses the same method. The reported Bitget incident appears to involve backend wallet infrastructure rather than the direct theft of customer passwords or cold-wallet private keys.
| Attack type | Typical method | Reported Bitget situation |
|---|---|---|
| Account takeover | Stealing a user’s login credentials | Not reported as the primary cause |
| Private-key theft | Obtaining cryptographic wallet keys | Bitget says keys were not obtained |
| Smart-contract exploit | Abusing vulnerable blockchain code | Not identified as the main method |
| Social engineering | Manipulating staff or users | Still under investigation |
| Backend compromise | Accessing internal transaction systems | Identified in the preliminary assessment |
| Fraudulent withdrawal | Submitting fake customer requests | Bitget says this did not occur |
This difference matters because customer security actions such as changing passwords may not address the core vulnerability. The exchange must examine internal access controls, transaction verification processes, system segmentation, and wallet authorization procedures.
What Bitget Users Should Do Now
Bitget users should remain cautious while the investigation and withdrawal suspension continue.
Follow Official Announcements
Check withdrawal restoration and reimbursement information through Bitget’s official channels. Do not trust direct messages from accounts claiming to represent the company.
Avoid Fake Recovery Services
Legitimate exchange representatives should not ask users to reveal seed phrases, private keys, passwords, or authentication codes. Anyone requesting this information is likely attempting fraud.
Review Account Activity
Users should inspect login records, authorized devices, API keys, withdrawal addresses, and recent transactions for anything unfamiliar.
Strengthen Account Security
Although the reported breach involved exchange infrastructure, users can still improve personal account protection by:
- Enabling app-based two-factor authentication
- Using a unique password
- Removing unused API keys
- Activating withdrawal address whitelisting
- Reviewing active login sessions
- Avoiding links received through unsolicited messages
Consider Personal Custody Risks
Self-custody gives users direct control over their assets, but it also places responsibility for private-key security entirely on them. Exchange custody and self-custody have different risks, so users should choose based on their technical knowledge and ability to protect wallet credentials.
What the Hack Means for Centralized Exchanges
The Bitget incident demonstrates that protecting private keys alone may not be enough. Exchanges also need strong controls around every backend system capable of creating, approving, or modifying transactions.
Effective defenses may include:
- Multiple independent transaction approvals
- Hardware-enforced signing policies
- Strict limits for hot-wallet transfers
- Real-time behavioral monitoring
- Network segmentation
- Privileged-access management
- Delayed approval for unusual transactions
- Independent verification of transaction data
- Regular incident-response exercises
- Transparent proof-of-reserves reporting
Exchanges must also test whether compromised internal services can supply false information to otherwise legitimate signing systems. A transaction authorization process is only as reliable as the data and systems feeding it.
Frequently Asked Questions
How much cryptocurrency was stolen from Bitget?
Bitget reported that approximately $351.6 million in digital assets was affected. This figure is commonly rounded to $352 million in news coverage.
Has North Korea been confirmed as responsible?
No final public attribution has been announced. Bitget suspects a North Korean group based on IP behavior, VPN patterns, attack similarities, and on-chain evidence, but the investigation remains active.
Were Bitget’s cold wallets hacked?
Bitget said its cold wallets remained secure. The incident reportedly affected a limited portion of its hot and warm wallet infrastructure.
Did the hackers steal customers’ private keys?
Bitget said the attackers did not obtain the private keys of its cold, hot, or warm wallets. The preliminary explanation points to a compromised backend wallet service and manipulated transfer data.
Will Bitget users lose their funds?
The exchange said customer balances remain accurate and that its User Protection Fund can cover the incident. Users should continue monitoring official updates for confirmation about withdrawals and reimbursements.
Why were Bitget withdrawals suspended?
Withdrawals were suspended to prevent additional unauthorized transfers and allow investigators to confirm that the affected systems had been secured.
Was the self-custodial Bitget Wallet affected?
Bitget said its self-custodial wallet was not affected because it uses infrastructure independent of the centralized exchange.
Can the stolen cryptocurrency be recovered?
Some assets may be frozen or recovered through blockchain tracing and cooperation with issuers, exchanges, and blockchain foundations. Full recovery is uncertain because attackers can distribute and convert funds across numerous networks.
Conclusion
Bitget Links North Korean Hackers to $352 Million Crypto Theft based on preliminary IP evidence, VPN patterns, and similarities with earlier cyber operations. The exchange says the breach affected parts of its hot and warm wallet infrastructure while cold wallets, customer balances, and its self-custodial wallet remained secure. Final responsibility has not been established, making the continuing technical and law-enforcement investigations essential.
