Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
Bitget says suspected North Korean hackers stole $351.6 million from hot and warm wallets after a backend compromise.
Cryptocurrency exchange Bitget said suspected North Korean hackers stole $351.6 million from a limited set of hot and warm wallets on September 24, 2026. The attackers compromised a critical backend system in the wallet infrastructure, spoofed transaction data, and triggered Bitget's authorization process to move funds. Impacted assets include ETH, XRP, BNB, AVAX, USDT, and USDC on Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Cold wallets, customer balances, and the separate self-custodial Bitget Wallet were unaffected; withdrawals were paused while Mandiant and SlowMist investigate.
- Bitget reported $351.6 million stolen from hot and warm wallets on September 24, 2026.
- Attackers compromised a backend wallet system, spoofed transaction data, and triggered fund authorizations.
- Cold wallets and customer balances were unaffected; withdrawals were temporarily suspended.
- Stolen assets include ETH, XRP, BNB, AVAX, USDT, and USDC across several chains.
- Mandiant and SlowMist are investigating; some chain foundations froze suspected addresses.
Full article348 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 25, 2026Cryptocurrency / Cybercrime
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets.
"At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain secure and unaffected."
The company emphasized that customer account balances remain accurate, and deposits and trading continue to operate normally. However, withdrawals have been temporarily suspended out of an abundance of caution while a "comprehensive security review" is underway.
Bitget did not disclose any details on how the attack took place, but said it has enlisted the help of Google-owned Mandiant and SlowMist for a third-party investigation.
"Bitget Wallet operates as a self-custodial wallet on a completely separate and independent infrastructure from Bitget Exchange and was not affected by this incident," it noted.
According to Bitget CEO Gracy Chen, assets impacted by the hack include ETH, XRP, BNB, AVAX, USDT, and USDC, with the chains involving Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base.
"We have contacted the foundations of all affected chains, and some foundations have confirmed the freezing of hacker wallet addresses," Chen said. "Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations."
"The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation."
The development comes about a week after SentinelOne attributed the North Korea-linked TraderTraitor group to an attack targeting an India-based information technology (IT) services company. TraderTraitor is best known for the theft of $1.5 billion from Bybit and $292 million from KelpDAO's LayerZero bridge.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.