- Bitget lost $351.6 million from hot and warm wallets on September 24, 2026, in an attack attributed to North Korean hackers.
- The exchange confirmed cold wallets remain secure, and customer balances are unaffected, but withdrawals are temporarily suspended.
- Affected assets include ETH, XRP, BNB, AVAX, USDT, and USDC across multiple blockchains, with some frozen by foundations.
- CEO Gracy Chen stated the attacker compromised a backend system to spoof transaction data, and investigations involve Mandiant and SlowMist.
On September 24, 2026, cryptocurrency exchange Bitget reported that suspected North Korean threat actors stole $351.6 million from its hot and warm wallets. The company stated that its security systems detected unauthorized transfers at 18:31 UTC, but cold wallets and the vast majority of platform assets remain secure.
Bitget assured that customer account balances are accurate and trading continues normally, but withdrawals are temporarily suspended for a comprehensive security review. The exchange has enlisted Mandiant and SlowMist for a third-party investigation, though it did not disclose how the attack occurred.
Bitget also noted that its self-custodial wallet operates on separate infrastructure and was not compromised. According to CEO Gracy Chen, assets impacted include ETH, XRP, BNB, AVAX, USDT, and USDC on chains such as Ethereum, Arbitrum, and Avalanche.
Chen explained that on-chain analysis and IP behavior patterns closely match known North Korean hacker tactics. “The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.” No further unauthorized transfers are possible, and the exact intrusion method remains under active investigation.
This incident follows a recent attack attributed to the North Korea-linked TraderTraitor group, which previously stole $1.5 billion from Bybit and $292 million from KelpDAO’s LayerZero bridge.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
