# Bitget Blames North Korea-Linked Hackers for $388 Million Theft That Bypassed Its Signing Controls

The attacker never took a private key, and about $83 million of the stolen XRP has already moved because Ripple has no power to freeze the ledger's native asset.

- Published: 2026-09-27T05:54:44.199Z
- Canonical: https://polylog.news/crypto/2026-09-27/bitget-blames-north-korea-linked-hackers-for-388-million-the
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze), [crypto.news](https://crypto.news/bitget-offers-bounty-freezing-funds-stolen-in-attack/), [Bitcoin Magazine](https://bitcoinmagazine.com/news/north-korea-linked-to-bitget-hack), [Polylog editors](https://polylog.news), [crypto.news (withdrawals)](https://crypto.news/bitget-to-resume-withdrawals-in-stages-starting-sep-28/)

Bitget's security systems flagged unauthorized transfers from several of its hot wallets at 18:31 UTC on Thursday, 24 September. In the exchange's account of the incident, the attacker did not steal private keys at all. It compromised a backend wallet system, inserted false transfer instructions, and pushed those instructions through Bitget's own authorization-signing process, which approved them as legitimate.

Chief executive Gracy Chen said investigators traced internet protocol addresses to virtual private network services previously used by a North Korean hacking group, and that the attack pattern resembled earlier operations attributed to the country. [Bitcoin Magazine put the loss at $388 million](https://bitcoinmagazine.com/news/north-korea-linked-to-bitget-hack), while Bitget's first public figure was [$351.6 million](https://crypto.news/bitget-offers-bounty-freezing-funds-stolen-in-attack/) and [CNBC reported $352 million](https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html). Bloomberg reported that the incident pushes thefts attributed to North Korea past [$1 billion for 2026](https://www.bloomberg.com/news/articles/2026-09-25/bitget-hack-pushes-north-korean-crypto-haul-past-1-billion). The attribution rests on network metadata and behavioral similarity rather than a government finding. The independent investigator Specter Analyst has separately linked the operation to the Lazarus Group and to a $24 million theft at the AFX exchange in July.

Chen has offered a 5% bounty for freezing stolen assets and a further 5% for recovering them. The freezing request works unevenly across assets. [CoinDesk reported that roughly $83 million of stolen XRP has already been moved](https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze), with two of five holding wallets nearly emptied and about $75 million left. That happened because the XRP Ledger's freeze function applies to tokens issued on the ledger, not to native XRP. Bitget says no customer funds were lost and will restart withdrawals in stages, [beginning with Bitcoin on 28 September](https://crypto.news/bitget-to-resume-withdrawals-in-stages-starting-sep-28/), then Ether on the 29th, Tether's USDT on the 30th, and remaining tokens and fiat on 2 October, a schedule Bitget also circulated [directly to traders](https://t.me/BWEnews/16494).

## What this means

The failure occurred in an operational control that worked exactly as written: the signing system authorized transfers it was asked to authorize, because the request arrived through a trusted internal path. Exchange customers are exposed through Bitget's corporate balance sheet rather than through contract code, and how recoverable the loss is depends on how each stolen asset is designed, not on Bitget itself. Issuers of centralized stablecoins can freeze balances, Ripple cannot freeze native XRP, and Bitcoin cannot be frozen at all, which is why the attacker moved XRP first. The precedent is Bybit's February 2025 breach, where a comparable signing-path compromise was followed by a solvency demonstration, a phased withdrawal restart, and no loss to customers. The likelier outcome over the coming weeks is that Bitget completes its phased restart and absorbs the loss itself, while the practical fight shifts to freeze-capable assets and the exchanges that receive the stolen funds. If withdrawal reopening slips past the published dates, or the loss estimate rises again, that would point to a balance-sheet problem rather than a contained incident.

## What to watch

- Whether Bitget meets its own 28 September to 2 October withdrawal schedule, the clearest public test of whether the loss was absorbed without touching customer balances.
- How much of the stolen XRP reaches exchanges that honor freeze requests, which will show whether voluntary industry cooperation still works against a state-linked adversary.
- Whether any government agency, rather than the exchange or private analysts, confirms the North Korea attribution, since sanctions exposure for counterparties depends on an official finding.