Crypto exchange Bitget has confirmed the theft of about $351.6 million. CEO Gracy Chen says early traces point to hackers linked to North Korea. So far, it is the largest attack on a centralised exchange in 2026.
What happened?
On Thursday, 24 September 2026, at about 18:31 UTC, Bitget’s systems detected unauthorised transfers from part of its hot and warm wallets. The hackers made 19 transfers.
Among the stolen assets were XRP, ether, USDT, USDC, Avalanche and BNB, on the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. The largest position was about 103 million XRP, worth over $150 million.
Initial on-chain estimates put the loss at about $180 million. Bitget raised the figure once all chains were included.
How they stole it, according to the exchange
Chen says the attackers gained access to the back end of the wallet infrastructure, falsified transaction data and ran their own authorisation process on Bitget’s side. Private keys were not leaked. The cold wallet, which is offline, reportedly remained untouched.
Withdrawals are suspended. Deposits and trading are operating. The exchange promises that withdrawals will resume within hours or days, not weeks.
Why North Korea?
This is a suspicion, not a verdict. Chen said in a live stream on X that investigators found IP addresses matching VPNs previously used by a group from the DPRK (ed. North Korea). The pattern resembles earlier North Korean attacks.
Independent on-chain analysts link part of the stolen XRP to traces from an earlier attack on AFX, also associated with Triada / TraderTraitor.
North Korea has for years funded its regime through crypto theft. In 2025, it was blamed, among other things, for the massive attack on Bybit.
What about customers’ money?
Bitget says user balances are fully backed, and the loss will be covered by its User Protection Fund, which holds over $464 million. In theory, the exchange has the means to fill the hole.
The investigation is ongoing. Police and blockchain firms are involved.
$352 million has disappeared from hot wallets. The cold storage is intact. Customers are waiting for withdrawals. As for whether Pyongyang is behind it again, for now it remains „very likely.”
