Crypto exchange Bitget has confirmed a massive security breach in which approximately $351.6 million was stolen from its hot and warm wallets. The company says suspected North Korean hackers were behind the operation, which its systems flagged at 18:31 UTC on September 24, 2026. Bitget stressed that its cold wallets and most platform assets remain protected, customer balances are intact, and trading and deposits are fully operational. Withdrawals, however, are temporarily paused as the firm conducts a thorough security audit.
Attack Details, Assets Affected, and Response
The stolen assets include ETH, XRP, BNB, AVAX, USDT, and USDC across several chains—Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitget’s CEO stated that early investigations show the attacker compromised a critical backend system in the exchange’s wallet infrastructure. This breach enabled the attacker to forge transaction data, slipping past authorization mechanisms to illicitly move funds. Bitget insists no further unauthorized transfers are possible as the breach appears contained.
To verify and remediate the situation, Bitget has engaged two external security firms—Mandiant (owned by Google) and SlowMist—to conduct independent investigations. The exchange also clarified that its self-custodial service, Bitget Wallet, runs on entirely separate infrastructure and remains unaffected by the incident.
Attribution to North Korean Hackers
According to Bitget, signs from chain analysis and IP behavior strongly point to a modus operandi linked with North Korean state-backed hacker groups. Multiple blockchains that were affected include major ecosystems such as Ethereum, Avalanche, and BSC. Several foundations associated with these chains have already frozen addresses connected to the attacker.
This incident is part of a larger trend: just days before, cybersecurity firm SentinelOne attributed another attack to TraderTraitor, a group tied to North Korea, responsible for huge heists like the $1.5 billion stolen from Bybit and $292 million from KelpDAO.
Bitget did not detail how the backend intrusion was achieved, stating only that the method is under active investigation. Meanwhile, users are being reassured over the integrity of their balances and the continuity of most operations, though withdrawals are on pause pending completion of the security review.
Why this matters: This breach puts a spotlight on how exchanges manage their backend infrastructure—one area attackers increasingly target because it can bypass user-facing defenses like two-factor authentication. The involvement of North Korean-linked threat actors underscores the growing geopolitical dimension to crypto risk. Going forward, watch whether other crypto firms adopt more compartmentalization between backend systems and hot/warm wallets, invest in enhanced transparency around incident response timelines, and how regulators respond to such large-scale cross-chain thefts.
