Skip to content
$BTC$83,613+0.1%$ETH$2,681−0.3%$SOL$117.97−0.8%$XRP$1.49−0.4%$TON$1.51+0.8%MCap$2.84T−0.6%BTC.D58.9%Fear&Greed71 GreedGas0.30 gwei·3.3 sat/vBNews mood20% bullish
Basis Desk
Security & Hacks · 2 min read

Bitget Loses $351.6M in Hot Wallet Breach Linked to North Korea

Attackers manipulated backend authorization data across seven networks in the largest crypto theft of 2026, though Bitget says its $464 million reserve covers the balance.

Editorial oversight: Julian Mercer, Chief Editor
Bearish
$BTC $83,613 +0.1% $ETH $2,681 −0.3% $XRP $1.49 −0.4% $TRX $0.3379 +0.8%

Key points

  • Bitget suffered a $351.6M breach across seven chains on Sept. 24, making it the largest crypto heist of 2026 so far.
  • The attacker manipulated internal authorization data to trigger hot and warm wallet transfers without stealing private keys.
  • On-chain laundering patterns directly overlap with North Korean hacking syndicate TraderTraitor, though TRM has not formally attributed the attack.

Cryptocurrency exchange Bitget lost an estimated $351.6 million on Sept. 24 after attackers compromised its backend systems to siphon funds from hot and warm wallets, according to blockchain analytics firm TRM Labs 1. The breach spans seven networks, including Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base 1. Bitget identified the illicit activity at 18:31 UTC, halted withdrawals, and confirmed its cold storage remained untouched 1. At the time of writing, major crypto markets held flat, with $BTC trading at $83,488 and $ETH at $2,668.

According to Bitget CEO Gracy Chen, the intrusion did not involve stolen private keys 1. Instead, the perpetrator accessed an internal backend system tied to wallet controls, spoofed transaction parameters, and tricked the exchange's authorization process into approving the unauthorized outflows 1. Early industry estimates pegged the theft at $170 million to $190 million by examining EVM networks alone, but on-chain data logged an additional $158 million in $XRP and $7 million in $TRX 1. Bitget stated that its $464 million User Protection Fund will fully absorb the balance 1.

Laundering Footprint Points to TraderTraitor

Chen noted that North Korean involvement is "very likely," citing internal telemetry linking connecting IP addresses to VPN infrastructure tied to state-sponsored hackers 1. While TRM Labs has stopped short of formal attribution, the firm revealed that the laundering network moving Bitget's assets overlaps directly with infrastructure deployed in previous North Korean operations, including the February 2025 Bybit breach and the AFX Bridge heist 1. On-chain trackers have not seen this specific laundering network operate with any other syndicate, pointing toward the North Korean threat group TraderTraitor 1.

Following the incident, the stolen assets were rapidly fractured into round balances—primarily 10,000 $ETH and 20 million XRP increments—across newly generated addresses, where the vast majority remained stationary through the morning of Sept. 25 1. Portions on BNB Chain and TRON were converted into Bitcoin via THORChain, SunSwap, and cross-chain routing services 1. If formal attribution confirms Pyongyang's role, North Korean crypto theft in 2026 would surpass $1 billion, trailing only 2025's historic totals 1.

Questions this story raises

Were private keys compromised in the Bitget breach?
No. Bitget reported that private keys were not stolen; rather, an attacker penetrated backend systems to spoof transaction approval data.
Are customer funds at Bitget protected?
Bitget stated that its cold storage was unaffected and that its $464 million User Protection Fund covers the entire $351.6 million loss.
Has the attack been definitively attributed to North Korea?
Bitget called North Korean involvement very likely based on VPN IP links, and TRM Labs verified laundering overlaps with TraderTraitor networks, though technical attribution remains ongoing.

Sources

  1. [1] Bitget Loses USD 351.6 Million in Hot Wallet Breach in Likely North Korea Attack — trmlabs.com, September 30, 2026

Written by Basis Desk's newsroom system from the primary sources above and machine-verified against them before publication. Market figures marked "at the time of writing" come from live exchange data. Report an error: corrections@basisdesk.news · corrections policy.

Community read
How do you read this story for the assets involved? One vote a day, anonymous.
Be the first to vote
Share X Telegram Bluesky Markdown

Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.