NewsPublished 25 Sep 2026

North Korea Suspected in $351 Million Bitget Crypto Heist

Source SecurityWeek

Description

Bitget, a centralized cryptocurrency exchange, suffered an unauthorized transfer of approximately $351.6 million in digital assets on September 24, 2026. The attack involved the compromise of a critical backend system in the wallet infrastructure, allowing fraudulent transfers without compromising private keys. The stolen funds originated from a small number of hot wallets, while cold wallets remained unaffected. The attack method resembles known North Korean hacker group tactics, though specific attribution details have not been disclosed. Some attacker-linked wallet addresses have been frozen by blockchain foundations. Investigations are ongoing with assistance from Mandiant and SlowMist.

Impact

The attacker successfully transferred approximately $351.6 million in cryptocurrency from Bitget's hot wallets, impacting multiple blockchain assets, with XRP suffering the largest loss on a single chain. The compromise affected Bitget's backend wallet infrastructure but did not involve private key theft or cold wallet compromise. The incident represents a significant financial loss and potential reputational damage to Bitget. Some attacker-linked wallet addresses have been frozen, potentially limiting further fund movement.

Defensive guidance

Bitget's security systems detected and halted unauthorized transfers promptly, and some attacker-linked wallet addresses have been frozen by blockchain foundations. The company is investigating the root cause with external cybersecurity experts. No private keys were compromised, and cold wallets remain secure. Users of Bitget Wallet, which operates on separate infrastructure, were not affected. Stakeholders should monitor official updates from Bitget and relevant authorities. Patch status is not applicable as this is an incident involving operational security compromise rather than a software vulnerability.

Summary

On September 24, 2026, Bitget detected unauthorized transfers totaling about $351.6 million across multiple cryptocurrencies including ETH, XRP, BNB, AVAX, USDT, and USDC. The attacker exploited a critical backend system within Bitget's wallet infrastructure to approve fraudulent transfers without accessing private keys. The funds were taken from hot wallets; cold wallets were not compromised. Bitget's CEO indicated that the attack patterns and IP behavior are consistent with North Korean state-sponsored hacker groups, though no specific group was named. Some blockchain foundations have frozen wallet addresses linked to the attacker. The incident has been reported to authorities, and cybersecurity firms Mandiant and SlowMist are assisting with the investigation.

References

securityweek.com/north-korea-suspected-in-351-million-bitget-crypto-heist/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Sep 2026, 14:17 UTC

References

Community reviews