Cryptocurrency exchange Bitget Says North Korea-Linked Hackers Stole $351.6 Million
Bitget says suspected North Korea-linked hackers stole $351.6 million from hot and warm wallets.
Cryptocurrency exchange Bitget said suspected North Korea-linked attackers stole $351.6 million on September 24, 2026, from a limited set of hot and warm wallets holding ETH, XRP, BNB, AVAX, USDT, and USDC. The company said the attacker compromised a backend wallet system, spoofed transaction data, and bypassed authorization. Withdrawals were suspended while deposits and trading continued. Mandiant and SlowMist are investigating; Bitget said user balances, cold wallets, and the separate self-custodial Bitget Wallet were unaffected and that its User Protection Fund covers the loss. CEO Gracy Chen said some blockchain foundations froze suspected hacker addresses.
- About $351.6 million left Bitget hot and warm wallets on September 24.
- Attacker allegedly spoofed transactions after compromising the wallet backend.
- Assets included ETH, XRP, BNB, AVAX, USDT, and USDC.
- Mandiant and SlowMist are investigating; some hacker wallets were frozen.
- Bitget says customer balances, cold wallets, and Bitget Wallet were unaffected.
Full article539 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 25, 2026
Bitget says suspected North Korea-linked actors stole $351.6M from hot and warm wallets. Withdrawals were suspended while Mandiant investigates.
Cryptocurrency exchange Bitget says suspected North Korea-linked threat actors stole $351.6 million from a limited number of hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals.
— Bitget (@bitget) September 24, 2026At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limited number of hot wallets.
Our security team immediately activated emergency response procedures and began a full investigation.
Based on our current assessment,… https://t.co/7xF5xW0JQ1
Bitget said customer balances, cold wallets and most platform assets remain secure. Mandiant and SlowMist are investigating the incident, while deposits and trading continue normally.
“We are currently working with independent third-party experts Mandiant and SlowMist for a full investigation. Our first priority is our users. User balances remain intact, and Bitget’s User Protection Fund covers the impact on this platform-wide incident.” the company added. “Bitget Wallet operates as a self-custodial wallet on a completely separate and independent infrastructure from Bitget Exchange and was not affected by this incident. Bitget Wallet users’ assets remain onchain under users’ control and remain unaffected.”
— Bitget (@bitget) September 25, 2026[UPDATES] We are currently working with independent third-party experts Mandiant and SlowMist for a full investigation.
Our first priority is our users. User balances remain intact, and Bitget's User Protection Fund covers the impact on this platform-wide incident.
Bitget…
Bitget CEO Gracy Chen said the security breach affected ETH, XRP, BNB, AVAX, USDT and USDC across several blockchains. The attacker reportedly compromised a backend wallet system, spoofed transaction data and bypassed the authorization process to move funds. Bitget said affected blockchain foundations were contacted and some have frozen hacker wallets.
“We have contacted the foundations of all affected chains, and some foundations have confirmed the freezing of hacker wallet addresses,” Chen explained. “Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations.”
— Gracy Chen @Bitget (@GracyBitget) September 25, 2026Here is what we can confirm at this stage:
On the attack:
Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization… https://t.co/5nINjwbXpC
Bitget is a cryptocurrency exchange and Web3 company founded in 2018. It provides services for buying, selling and trading digital assets, including spot and futures trading, copy trading and other financial products. The company has expanded beyond crypto into traditional markets and now describes itself as a “Universal Exchange.” Bitget says it serves more than 120 million users in over 150 countries and regions.
The attribution to North Korea-linked threat actors doesn’t surprise. According to Chainalysis, North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025, bringing the estimated total stolen by DPRK-linked actors to $6.75 billion.
The thefts increasingly target crypto exchanges and other digital-asset services, with attackers using techniques ranging from sophisticated cyber intrusions to fake IT-worker identities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Bitget)