What Happened

A $387.5 million theft from Bitget on September 24 has become the largest crypto exploit of 2026, and investigators say the technical fingerprints point back to North Korea. Bitget CEO Gracy Chen said the exchange identified IP addresses tied to VPN infrastructure previously used by North Korean hacker groups, and blockchain analytics firm Elliptic separately flagged overlaps with wallets from the $1.5 billion Bybit hack, attributing the intrusion to the group tracked as “TraderTraitor,” according to The Star. What makes the case notable for a technical audience isn’t just the attribution, it’s how the attackers got past Bitget’s approval layer without ever touching a private key.

Key Takeaways

  • Bitget lost $387.5 million after attackers forged approvals inside its backend wallet system, while cold wallets and private keys stayed uncompromised.
  • CEO Gracy Chen said VPN infrastructure used in the attack matches patterns tied to North Korean hacker groups, though she later called the North Korea link a preliminary indicator still under review.
  • Stolen stablecoins and tokenized gold were swapped into ETH on decentralized exchanges within minutes to dodge blacklisting, while native assets like XRP and BNB were fragmented across dozens of wallets.
  • Elliptic says the incident pushes North Korea’s 2026 crypto theft total past $1 billion across more than 50 tracked incidents.
  • Bitget’s $464 million User Protection Fund will cover the full loss, and withdrawals resume on a staggered schedule starting September 28.

How the Backend Was Compromised

The exploit didn’t touch Bitget’s cold storage or its private keys at all. According to Chen’s comments to Cointelegraph, the attacker exploited a vulnerability in a third-party security product to obtain “high-level internal credentials,” then used those credentials to issue fraudulent withdrawal commands. Tom’s Hardware describes the same event as forged transfer approvals that tricked the backend wallet system into authorizing transactions it should have rejected. Both descriptions point to the same failure mode: an internal approval process that trusted credentials it shouldn’t have, rather than a break-in at the custody layer.

Bitget detected abnormal transfers from its hot wallets on Thursday afternoon Eastern time and moved to suspend withdrawals while deposits and trading kept running, per Euronews. The exchange has since said it fixed the underlying flaw and added independent verification steps and increased monitoring around withdrawals, according to Cointelegraph. The loss figure itself moved through several revisions: on-chain analysts initially estimated $170 million to $183 million, Bitget’s own early tally put it at $351.6 million, and a full audit later set the final number at $387.5 million.

Laundering Designed to Beat Freezes

Once the funds were out, the attackers moved fast to stay ahead of blacklisting tools. Stablecoins, including USDT and USDC, along with tokenized gold (XAUt), were swapped directly into ETH on decentralized exchanges within minutes of the theft, according to Tom’s Hardware, a move that sidesteps the freeze mechanisms issuers like Circle and Tether can apply to their own tokens. Native layer-1 assets that can’t be frozen or reversed, including XRP, ETH, BNB, and TRX, were instead fragmented and spread across dozens of new attacker-controlled wallets.

Bitget has also pushed for cooperation from cross-chain infrastructure. The exchange asked THORChain to refuse service to addresses tied to the attack, but the protocol responded that it cannot selectively blacklist individual addresses, a technical constraint Chen said Bitget respects, per Cointelegraph. To pull funds back, Bitget launched a recovery-bounty program offering up to 5% of any amount frozen or recovered.

The attribution has firmed up in some places and softened in others. Chen initially told her X livestream the VPN pattern made a North Korean connection “very likely” and said individuals she identified as Lazarus members had previously approached her posing as a journalist to arrange a Zoom interview, according to Euronews. Elliptic went further, citing on-chain overlaps with prior DPRK-linked laundering, including addresses connected to the Bybit exploit, to name TraderTraitor specifically.

But Chen later walked the certainty back somewhat, telling Cointelegraph that “what was shared previously was based on preliminary indicators identified during the investigation” and that those indicators are still being assessed by forensic partners Mandiant and SlowMist. That gap between an early, confident public statement and a more cautious follow-up is itself part of the story: state attribution in these cases typically hardens over weeks, not days.

A Pattern With a Running Total

Elliptic’s broader tracking puts North Korea-linked groups behind more than 50 security incidents in 2026 alone, totaling roughly $1.2 billion, a figure the Bitget hack now sits inside, per The Star. TRM Labs had separately found DPRK groups responsible for 76% of value stolen in crypto hacks through April, a figure that predates this incident. The Bitget breach follows a string of large 2026 exploits, including a $320 million Bitcoin theft from the Liquid Network that emptied nearly 95% of its federation wallet, and a $270 million hack of Drift in April, per Tom’s Hardware. The FBI attributed the record $1.5 billion Bybit theft in February 2025 to North Korean hackers using similar rapid-conversion and address-fragmentation tactics.

What to Watch

Bitget’s staggered withdrawal restart began September 28, and the exchange has not yet disclosed how much of the stolen $387.5 million has been frozen or recovered through its bounty program. Mandiant and SlowMist’s forensic review is ongoing, and Chen has said Bitget will share further findings once the North Korea indicators are verified rather than preliminary.

Sources