Bitget Hack Steals $387M,
Pushes North Korea Past $1B
Attackers never touched a private key. They spoofed Bitget’s wallet backend so fraudulent withdrawals looked completely legitimate.
The Bitget hack didn’t start with a stolen key, and that’s what makes it unusual. On September 24, Bitget’s security systems flagged abnormal transfers leaving its hot and warm wallets at 18:31 UTC. Within about an hour, on-chain investigators had already tracked roughly $183 million moving out. By the time Bitget went public hours later, the confirmed loss stood at $351.6 million. A day after that, once the exchange finished accounting for Zcash and TRON holdings caught up in the breach, the final tally landed at $387.5 million, the largest crypto exchange hack of 2026.
What makes the Bitget hack different from a typical wallet drain is how the money left. Attackers didn’t need a private key at all. According to reporting on the breach mechanics, they exploited Bitget’s wallet backend system, spoofing the data describing each transaction so fraudulent withdrawals were approved as if they were routine, legitimate transfers. Roughly $352 million moved out across eight blockchains in two timed bursts, with the single largest piece, about 103 million XRP worth $157 million, among the assets taken.
This piece breaks down how the spoofing worked, why CEO Gracy Chen is pointing at North Korea, how this fits into Pyongyang’s record year, and what Bitget is doing for the users whose funds were caught in the middle.
What Broke in the Bitget Hack
Bitget’s wallet backend, the system that verifies and approves withdrawal transactions, was tricked into approving fraudulent transfers.
How the Money Left
No private key was stolen. Spoofed transaction data made fraudulent withdrawals look like routine, legitimate transfers.
Who’s Suspected
CEO Gracy Chen points to North Korea, citing IP addresses, on-chain patterns, and ties to the Bybit hack’s stolen funds.
What Happens to Users
Bitget’s $464M User Protection Fund will cover the full loss, so customer balances stay intact.
The Bitget Hack, Minute By Minute
TimelineBitget’s security systems flagged unauthorized transfers from hot wallets at 18:31 UTC on September 24. On-chain investigators were tracking roughly $183 million leaving within the hour, well before Bitget made any public statement. The exchange confirmed the breach publicly later that night with an initial figure of $351.6 million, then revised the total up to $387.5 million the next day.
No Stolen Key, Just a Spoofed Approval
Root CauseMost exchange hacks involve a compromised private key or signer. This one didn’t. Attackers exploited a flaw in Bitget’s wallet backend, the system responsible for verifying withdrawal requests, and made fraudulent transfers appear as legitimate, pre-approved transactions. About $352 million moved out across eight separate blockchains in two timed bursts, with roughly 103 million XRP, worth about $157 million, as the single largest piece taken.
Why North Korea Is the Prime Suspect
AttributionDuring a three-hour livestream, CEO Gracy Chen said the attack bore the hallmarks of North Korean state-sponsored actors, citing IP addresses tied to VPN infrastructure previously linked to North Korean hacking groups, along with matching behavioral patterns and on-chain signatures. Independent researchers added more: MetaMask’s Taylor Monahan found Bitget’s stolen funds landed in an address that had previously received money from the Bybit hack, and blockchain analytics firm Elliptic confirmed overlapping laundering routes.
A Record Year for North Korean Crypto Theft
Bigger PictureElliptic says the Bitget theft pushes North Korea’s confirmed 2026 crypto haul past $1 billion, a milestone the country used to take a full year to reach and this year hit in under nine months. It’s still smaller than the $1.4 billion Bybit hack from February 2025, which the FBI formally attributed to North Korea’s Lazarus Group, also tracked as TraderTraitor, but it adds to a pattern UN investigators say has brought North Korea more than $2 billion from crypto platforms since last year alone.
The keys never had to move,
because the machine lied about what it was doing.
- Check Bitget’s official channels for the current status of withdrawals before attempting any transaction.
- Remember your balance is protected — Bitget says its $464M reserve fund covers the full loss, so customer funds are not at risk.
- Treat urgent “security update” messages with caution, since breaches like this one are often followed by phishing campaigns impersonating the exchange.
- Diversify where you hold significant crypto rather than keeping everything on a single exchange, regardless of how large its reserve fund is.
⚠️ Why the Bitget Hack’s “No Stolen Keys” Isn’t Reassuring
1. Backend trust is its own attack surface. If the system that verifies a transaction can be fooled, having secure key storage doesn’t matter, since the fraud happens one layer up.
2. This mirrors a growing pattern. North Korean-linked actors have increasingly targeted the infrastructure and approval logic around wallets rather than the keys themselves, since that logic is often less scrutinized.
3. Attribution without proof cuts both ways. Chen’s North Korea claim is backed by real on-chain evidence, but without formal government confirmation, exchanges and users are left acting on a strong hypothesis rather than a settled fact.