Security Widely confirmed 9 publishers 2 min read Published Sep 25, 2026, 2:59 AM PDT Updated Sep 28, 2026, 9:51 AM PDT

Suspected North Korean attackers used Bitget's own signing process to move $351.6M

Bitget says suspected North Korean attackers took $351.6 million from its hot and warm wallets by spoofing the transaction data that triggers its signing process. Its $464 million user protection fund, held in bitcoin, covers the loss.

The Watch · Security desk

Send a correction

Illustration accompanying Suspected North Korean attackers used Bitget's own signing process to move $351.6M — Generated illustration

What happened

Bitget found the breach Thursday evening, when its security systems flagged multiple unauthorized transfers out of a limited number of its crypto wallets.
CEO Gracy Chen said the losses span seven chains, including Ethereum, XRP Ledger, Arbitrum and Base, and that XRP was the largest single-chain loss.
Bitget said its cold wallets and most platform assets were untouched, and its self-custodial Bitget Wallet, which runs on separate infrastructure, was not affected.
All withdrawals are suspended, while deposits and trading continue and customer balances remain accurate, according to the company.

Why it matters

What it costs cost Bitget's reserve pays for this theft, which uses up about 76% of the fund and leaves roughly $112 million to cover any further loss.
What doesn't add up contradiction Bybit's $1.5 billion loss came out of an ETH cold wallet. Bitget's untouched cold storage limited this theft, but that does not show offline wallets cap exchange losses.
What it limits constraint A theft on Bybit's scale would be about 3.2 times Bitget's fund, more than the reserve that makes customers whole here could absorb.

Next story · Invest · Oct 3

Issuers and protocols have frozen about 0.2% of the $387 million taken from Bitget

Confirmed3 publishers

Bitget's account puts the failure in the data path that feeds its signer. "The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out," Bitget CEO Gracy Chen said ^[6]. By the company's description, its own authorization-signing process released the funds after acting on forged transfer information ^[5]. The company has not said how the intruder got into the backend wallet service ^[5]. Chen said the method "remains under active investigation" ^[6].

Containment, as Bitget describes it, is holding. "No further unauthorized transfers are possible," Chen said ^[6]. Some chains have frozen the attacker's wallet addresses since the theft, according to Chen ^[14]. Bitget said it will restore withdrawals once investigators confirm it is safe to resume normal operations ^[9].

The fund paying for this is held in bitcoin. It is 5,500 BTC, which Bitget valued at about $464 million, or roughly $84,400 a coin ^[7]^[20]. Those 5,500 BTC cover a $351.6 million loss only while bitcoin trades above about $63,900. That price is roughly 24% below the valuation Bitget gave ^[18].

The North Korea attribution on record comes from Bitget, through Chen. "Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations," Chen said ^[22]. Mandiant and SlowMist are assisting, alongside law enforcement and on-chain security institutions ^[12]. The reporting cites no finding from any of them. If Chen's attribution holds, Bitget is the latest in a run of major crypto thefts that BleepingComputer links to North Korean hackers ^[3].

What to watch

Whether Mandiant or SlowMist publish how the backend wallet service was breached, and whether their findings back Bitget's North Korea attribution.
The date Bitget restores withdrawals, and whether it draws on the 5,500 BTC fund before a move in bitcoin's price narrows the coverage margin.
How much of the $351.6 million sits in the attacker addresses that some chains have frozen.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption: Not scored
Hype gap+25
Incentives70
Confidence60

Perspective Coverage

10 publishers

Builder: Builder 27%
Operator: Operator 42%
Investor: Investor 31%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Bitget disclosed that suspected North Korean hackers stole $351.6 million from its hot and warm wallets.
Reported SupportedView cited source
[2]
Bitget has temporarily suspended all withdrawals while it investigates.
Reported SupportedView cited source
[3]
North Korean hackers have previously been linked to many other major crypto theft incidents.
Reported Supported Source: BleepingComputerView cited source
[4]
In the Bybit heist, North Korean hackers stole $1.5 billion from the exchange's ETH cold wallet.
Reported Supported Source: BleepingComputerView cited source
[5]
Bitget has not shared how the attackers accessed its key backend wallet-service system to forge transfer information and trigger the authorization-signing process.
Reported SupportedView cited source
[6]
"The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation."
Reported Supported Source: Gracy Chen, Bitget CEO, quoted by BleepingComputer (statement continues directly from her attributed quote)View cited source
[7]
Bitget's User Protection Fund holds 5,500 BTC, currently worth about $464 million, and Bitget says it will cover all losses.
Reported SupportedView cited source
[8]
Bitget discovered the breach Thursday evening after its security systems flagged multiple unauthorized transfers from a limited number of crypto wallets.
Reported SupportedView cited source
[9]
Bitget said it will restore withdrawals as soon as possible, after investigators confirm it is safe to resume normal operations.
Reported SupportedView cited source
[10]
"Bitget's cold wallets and the overwhelming majority of platform assets remain secure and unaffected," Bitget said.
Reported Supported Source: Bitget company statement, via BleepingComputerView cited source
[11]
Bitget said customer account balances remain accurate and deposits and trading continue to operate normally.
Reported Supported Source: Bitget company statementView cited source
[12]
Bitget is investigating with law enforcement agencies, on-chain security institutions, and cybersecurity experts at Mandiant and SlowMist.
Reported SupportedView cited source
[13]
Bitget CEO Gracy Chen said the incident involved the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains and affected ETH, XRP, BNB, AVAX, USDT, USDC and other tokens, with XRP the largest single-chain loss.
Reported Supported Source: Gracy Chen, Bitget CEOView cited source
[14]
Chen said some chains have confirmed that the hacker wallet addresses have been frozen since the attack.
Reported Supported Source: Gracy Chen, Bitget CEOView cited source
[15]
Bitget said its self-custodial Bitget Wallet was not affected because it operates on infrastructure independent of Bitget Exchange.
Reported SupportedView cited source
[16]
The $351.6 million loss equals about 76% of the $464 million User Protection Fund.
Derived Supported
[17]
After covering the loss, the fund would have about $112 million left at its stated valuation.
Derived Supported
[18]
5,500 BTC covers $351.6 million only while bitcoin trades above about $63,900, roughly 24% below the per-coin price implied by the $464 million valuation.
Derived Supported
[19]
A $1.5 billion loss like Bybit's would be about 3.2 times Bitget's $464 million fund.
Derived Supported
[20]
The fund's valuation implies a bitcoin price of roughly $84,400.
Derived Supported
[21]
Chen named seven affected chains.
Derived Supported
[22]
"Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations. We have reported to relevant institutions and are fully cooperating in conducting a global investigation," Chen said.
Reported Insufficient Source: Gracy Chen, Bitget CEOView cited source

Sources

9 independent publishers whose own reporting we read for this story.

bleepingcomputer.com
3 articles · September 28, 2026
Hackers steal $351.6 million in Bitget crypto exchange hack
blockchain.news
4 articles · September 24, 2026
Bitget: North Korean Hackers Suspected in $351.6M Breach | Flash News Detail | Blockchain.News
hackread.com
1 article · September 24, 2026
Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group
infosecurity-magazine.com
1 article · September 28, 2026
Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach
scworld.com
1 article · September 25, 2026
Bitget loses $351.6 million in suspected North Korean crypto hack
securityaffairs.com
1 article · September 25, 2026
Cryptocurrency exchange Bitget Says North Korea-Linked Hackers Stole $351.6 Million
securityweek.com
1 article · September 25, 2026
North Korea Suspected in $351 Million Bitget Crypto Heist
thehackernews.com
2 articles · September 25, 2026
Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
therecord.media
1 article · September 25, 2026
Crypto CEO accuses North Korea of stealing $387 million from Bitget platform
web3isgoinggreat.com
1 article · September 23, 2026
Bitget crypto exchange hacked for $388 million, pauses withdrawals

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder27%

All of the technical account comes from Bitget. On September 25 the company said an attacker got into a critical backend system in its wallet infrastructure, spoofed transaction data and set off Bitget's own authorization process, without taking private keys. Three days later, Infosecurity Magazine reported Bitget's explanation of the way in: a flaw in a third-party security product gave the attacker high-level internal credentials, and the fraudulent withdrawal commands got past its risk controls. Bitget has not named the product. Mandiant and SlowMist are investigating, but neither is quoted in our coverage.

Operator42%

For customers, the withdrawal schedule matters most. Bitcoin withdrawals reopened at 08:00 UTC on September 28. ETH was due September 29, USDT September 30, and other tokens, fiat and P2P from October 2, as BleepingComputer and Infosecurity Magazine report. Deposits and trading stayed open. Chen said chain foundations had frozen attacker addresses, but web3isgoinggreat puts the stablecoin freezes by Circle and Tether at $318,000. Most of the stolen funds were swapped into assets that cannot be frozen.

Investor31%

The loss rose from $351.6 million to $387.5 million after Bitget reclassified Zcash and TRON transfers. Against a fund quoted at more than $464 million, that leaves about $76 million of room, compared with the $112 million Hackread calculated on the first figure. The fund is held as 5,500 BTC, so how much it covers moves with bitcoin's price. At the revised loss it stays sufficient while bitcoin trades above roughly $70,500, against about $84,000 in blockchain.news's market notes. Chen told her town hall, "If Bybit can hold on [after] a $1.5 billion loss, we can definitely hold on to a $350 million+ loss," as The Record reports.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence55: 0100
Company-sourced
Bitget is the source for every loss figure, the attack path and the North Korea attribution, through its posts, Chen's broadcast and her town hall. Independent reporting adds a little. web3isgoinggreat counted $318,000 in stablecoin freezes, and Hackread checked the attribution against what had actually been published.
AdoptionNot scored: Not applicable
This is a theft and its aftermath. Our coverage has no usage or uptake data beyond Bitget's own claim of more than 120 million users.
Hype gap+25: −100 understated0 aligned+100 overstated
Attribution ahead of proof
Chen blamed North Korea, and Lazarus by Hackread's account, citing IP patterns and on-chain analysis that nobody has published. SecurityWeek notes her post named no group. Several outlets kept the $351.6 million figure after Bitget had raised it by about $36 million.
Incentives70: 0100
Reassurance from the affected party
Nearly every fact comes from an exchange that had frozen withdrawals and needed customers to believe they would reopen. Its statements repeat that balances "remain accurate" and that the fund covers the loss. Chen also offered Bybit's recovery as a precedent for Bitget's own survival.
Confidence60: 0100
Incident firm, cause and culprit open
Ten publishers agree on the incident, its rough size and the withdrawal timeline, and Bitget's later updates match them. The cause is less settled because the third-party product is unnamed. The culprit is less settled because the attribution evidence has not been released.

Topics and entities

Topics

North Korean Crypto Theft
Crypto Exchange Security Operations