North Korean Suspects in Bitget's $351.6M Multi-Chain Crypto Heist

For security teams, the Bitget breach is not a routine wallet key theft: attackers bypassed the exchange's key backend wallet-service system to forge transfer information and trigger authorization signing across seven chains. The $351.6M exfiltration—largest crypto heist of 2026—underscores how centralized exchanges' warm transaction signing remains a high-value target. Understanding what the intrusion reveals about threat actor tradecraft is critical for defenders.

On September 25, 2026, cryptocurrency exchange Bitget disclosed that suspected North Korean hackers stole approximately $351.6 million from a limited number of its hot and warm wallets, making it the largest known digital-currency heist of the year. The breach was discovered Thursday evening, September 24, when internal security systems flagged multiple unauthorized transfers. Bitget has suspended all withdrawals while it investigates with law enforcement, on-chain security firms SlowMist and Mandiant. The company says its cold wallets and the overwhelming majority of platform assets remain secure, and that its $464 million User Protection Fund will cover the loss.

“

Bitget CEO Gracy Chen said the attack touched the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains, affecting ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens; XRP represented the largest single-chain loss.

The scope and mechanics set this incident apart. Bitget CEO Gracy Chen said the attack touched the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains, affecting ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens; XRP represented the largest single-chain loss. The company has not yet explained how attackers accessed its key backend wallet-service system, but it confirmed the intruders were able to forge transfer information and trigger the authorization-signing process. That detail implies compromise of internal transaction-approval workflows rather than a simple theft of user credentials or a single private key. It also explains why all withdrawals are paused: if the signing path is suspect, any further withdrawal could expose additional funds.

North Korean attribution remains based on IP behavior patterns and on-chain analysis, not a formal government determination. Yet blockchain intelligence firm TRM Labs notes North Korea is behind roughly three-quarters of all crypto thefts during 2026 to date. These operations are widely understood to fund the country's nuclear weapons program, and they frequently combine social engineering of developers, supply-chain attacks, and custom tooling to bypass exchange controls. Bitget's disclosure fits that profile, though Mandiant and SlowMist are still investigating.

Market and operational impact is substantial but contained by design. Bitget's User Protection Fund holds 5,500 bitcoin, worth about $464 million at the time of disclosure, exceeding the $351.6 million loss. Customer account balances remain accurate, deposits and trading continue, and the self-custodial Bitget Wallet was not affected because it operates on infrastructure independent of Bitget Exchange. Still, several chains have confirmed freezing hacker wallet addresses, which may limit laundering. The exchange has not said when withdrawals will reopen.

The heist eclipses a $340 million September 2026 hack in which the attacker returned all but $47 million. That earlier incident demonstrated a partial recovery; Bitget's outcome will depend on chain-level freezes, law enforcement coordination, and whether any portion can be clawed back. In contrast, this attack involved a broader set of chains and assets, complicating recovery.