Cryptocurrency exchange Bitget is investigating a major theft of approximately $351.6 million in digital assets from its wallet infrastructure, in what is shaping up to be one of the largest crypto exchange hacks reported in 2026.[1][3][11] The company and external analysts say the attackers used techniques consistent with North Korean state-backed hacking groups, though formal attribution has not yet been confirmed.[6][8][9]
Bitget said its security systems detected multiple unauthorized transfers from a subset of its hot and warm wallets at 18:31 UTC on September 24, triggering emergency response procedures within minutes.[1][3][10] The exchange has temporarily suspended all user withdrawals while it investigates, although deposits and trading remain online and customer account balances continue to show full value.[2][5][14] In a detailed security notice, Bitget stressed that its cold wallets were not accessed and that the incident was contained to the upper layers of its three-tier wallet architecture.[1][10]
The loss falls within the coverage of Bitget’s User Protection Fund, which the company says currently holds more than $464 million, including around 5,500 BTC earmarked to backstop security incidents.[1][7][8] Bitget has committed to covering all affected user assets and stated that balances on the platform will not be haircut as a result of the breach.[1][8][10] The firm also emphasized that its separate self-custodial Bitget Wallet product runs on independent infrastructure and was not impacted by the attack.[1][8]
Early technical findings suggest the intruders compromised a critical backend component within Bitget’s wallet environment, allowing them to initiate transfers directly without stealing core private keys, according to statements from the company and media reports.[3][8][9] A preliminary probe cited by Bitget indicates that private keys remained secure, pointing instead to a breach of internal systems or connected tooling that enabled the unauthorized on-chain movements.[1][3][9] Investigators have identified and flagged blockchain addresses associated with the stolen funds and are working with law enforcement agencies and on-chain analytics firms to trace the flow of assets.[1][8][10]
On the attribution side, Bitget chief executive Gracy Chen said IP behavior patterns, VPN usage, and on-chain signatures observed in the incident closely match techniques seen in previous operations linked to North Korean hacker organizations.[6][8][11] Chen and other commentators have pointed to similarities with campaigns attributed to the Lazarus Group, but she has also cautioned that the evidence remains circumstantial and that the probe has not yet produced definitive proof naming a specific DPRK unit.[9][12][13] Several reports note that some infrastructure used in the attack overlaps with services historically associated with North Korean threat actors, adding weight to suspicions even as the investigation remains open.[6][8][15]
For defenders across the cryptocurrency ecosystem, the Bitget breach underscores the continued risk posed by sophisticated state-aligned groups targeting exchange backend systems rather than only user endpoints or phishing campaigns.[8][11][15] While Bitget has promised to make its final incident report public, the exchange has said it will not speculate further about the precise attack vector until forensic work is complete, a stance that leaves other platforms watching closely for lessons on wallet segmentation, backend hardening, and rapid incident containment.[1][3][10]
References
- [SECURITY NOTICE] Bitget exchange hot wallets Incident
- Bitget Hit by $351.6M Hack, Exchange Freezes Withdrawals as …
- Bitget confirms $351.6 million exchange wallet breach after attacker compromises backend system
- Bitget suspends withdrawals after hackers take US$352mil
- North Korea Suspected in $351 Million Bitget Crypto Heist
- Bitget Exchange Reportedly Hacked For Over $170 Million
- Hackers steal $351.6 million in Bitget crypto exchange hack
- Bitget probe points to backend breach after $351.6M hack
- Bitget’s $351.6 million hack pushes September crypto …
- North Korean hackers suspected in $351M crypto theft, the largest so far this year | TechCrunch
- Who Bitget Believes Is…
- Hackers Drain $351.6 Million From Bitget Hot Wallets in …
- Bitget Exchange Wallet Suspected Of Security Breach After $170M Asset Movement
- Bitget $351.6M Hack: Withdrawals Frozen, Fund Claims Full …
