North Korean-linked hackers stole close to $388 million in digital assets from crypto exchange Bitget on September 24, 2026, after breaching its backend wallet infrastructure. Bitget paused withdrawals and says its User Protection Fund can absorb the loss without touching customer balances, while Mandiant and SlowMist join the investigation.
Bitget CEO Gracy Chen said Friday that hackers tied to North Korea took close to $388 million in digital assets from the exchange, more than the over $350 million she first reported. Bitget had detected the unauthorized transfers from its hot and warm wallets at 18:31 UTC on September 24, 2026 and moved quickly to suspend withdrawals.
Chen said the revised figure "reflects a more complete accounting of transfers during the incident". She attributed the breach to North Korean hacking groups, citing IP behavior patterns and on-chain analysis.
How the attackers got in
The breach did not involve stolen private keys. Instead, attackers exploited a vulnerability in Bitget's backend wallet infrastructure to spoof transaction authorization data and move funds without triggering standard authentication checks. Cold wallets were left untouched, unlike the hot wallets that took the hit.
Cybersecurity firm Mandiant and blockchain analytics firm SlowMist have since joined the investigation alongside law enforcement.
Losses keep climbing as tracing continues
The initial damage estimate came in at $351.6 million before investigators traced additional stolen assets on the Zcash and Tron networks, pushing the total to $387.5 million. The stolen assets mostly included ethereum, tron, and the USDT stablecoin, with no bitcoin among the funds initially identified as stolen — though a separate tracker shows the attacker now holding over $28.8 million in bitcoin.
Bitget's User Protection Fund holds over $464 million, enough to cover the revised loss with room to spare. Bitget's native token, BGB, dropped roughly 3.3% immediately after news of the hack broke.
A rough year for exchange security
At $387.5 million, this ranks as the largest single exchange hack of 2026. It follows a string of breaches that have kept the crypto community on edge: in July, hackers exploited a firmware bug in the Coldcard hardware wallet to steal nearly $120 million in user funds. This month, purported white-hat hackers withdrew about 4,000 bitcoin, worth about $320 million at the time, from Blockstream's Liquid sidechain federation wallet before returning 85% of it.
Sources: Bitcoin Magazine, Crypto Briefing
Trading involves risk.
Risk Disclaimer
