Bitget Blames North Korea-Linked Hackers for $388 Million Theft That Bypassed Its Signing Controls

Bitget's security systems flagged unauthorized transfers from several of its hot wallets at 18:31 UTC on Thursday, 24 September. In the exchange's account of the incident, the attacker did not steal private keys at all. It compromised a backend wallet system, inserted false transfer instructions, and pushed those instructions through Bitget's own authorization-signing process, which approved them as legitimate.

Chief executive Gracy Chen said investigators traced internet protocol addresses to virtual private network services previously used by a North Korean hacking group, and that the attack pattern resembled earlier operations attributed to the country. Bitcoin Magazine put the loss at $388 million, while Bitget's first public figure was $351.6 million and CNBC reported $352 million. Bloomberg reported that the incident pushes thefts attributed to North Korea past $1 billion for 2026. The attribution rests on network metadata and behavioral similarity rather than a government finding. The independent investigator Specter Analyst has separately linked the operation to the Lazarus Group and to a $24 million theft at the AFX exchange in July.

Chen has offered a 5% bounty for freezing stolen assets and a further 5% for recovering them. The freezing request works unevenly across assets. CoinDesk reported that roughly $83 million of stolen XRP has already been moved, with two of five holding wallets nearly emptied and about $75 million left. That happened because the XRP Ledger's freeze function applies to tokens issued on the ledger, not to native XRP. Bitget says no customer funds were lost and will restart withdrawals in stages, beginning with Bitcoin on 28 September, then Ether on the 29th, Tether's USDT on the 30th, and remaining tokens and fiat on 2 October, a schedule Bitget also circulated directly to traders.