North Korea named as primary suspect in $387 million Bitget crypto hack

North Korea may be behind a hack that drained over $387 million from crypto exchange Bitget, according to the company’s CEO Gracy Chen. Speaking during an X livestream on the evening of the September 24 hack, Chen said that the attack — the biggest in 2026 so far — bore the hallmarks of North Korean state-sponsored threat actors, citing suspicious IP addresses tied to VPN infrastructure previously used by North Korean hacker groups.

According to Chen, Bitget detected abnormal transfers from some hot wallets on Thursday afternoon Eastern time. The hackers exploited a backend wallet system that processes wallet transactions, forging transfer approvals that tricked the system into authorizing the fraudulent transactions. She confirmed that cold wallets and private keys remained safe and uncompromised. The stolen assets include Ether, XRP, USDT, USDC, Avalanche, and BNB across the Ethereum, XRP Ledger, Avalanche, BSC, and Arbitrum networks. Early independent on-chain analysis initially put the total stolen value at $170 million to $183 million, before Bitget announced an initial official value of $351.6 million. Comprehensive audits revised the final official value to $387.5 million.

Bitget temporarily froze user withdrawals, while deposits and trading remained functional. The company announced that its over $464 million User Protection Fund would cover the full loss. It says it has fixed the backend vulnerability and is rolling out a staggered withdrawal schedule — starting Monday, September 28 — to manage network traffic and ensure complete infrastructure security.

After the attack, the hackers quickly converted the USDT, USDC, and tokenized gold (XAUt) directly into ETH on decentralized exchanges within minutes of the theft to circumvent on-chain blacklisting or freezing of the stablecoins. Native layer-1 assets like XRP, ETH, BNB, and TRX, which cannot be frozen or reversed, were quickly fragmented and distributed across dozens of new attacker-controlled wallets. Meanwhile, Bitget launched a recovery-bounty program offering rewards of up to 5% for funds successfully frozen or recovered.

The incident is the latest in a series of hacks in the crypto industry. Earlier this month, attackers drained $320 million in Bitcoin from the Liquid Network, emptying nearly 95% of its federation wallet. A similar incident occurred in April when crypto platform Drift lost $270 million in a hack. Many of the hacks that have plagued the crypto industry have been linked to state actors, with North Korea leading the pack. In February 2025, the FBI identified the North Korean hackers as the perpetrators behind the biggest crypto hack in history, stealing over $1.5 billion from Bybit.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.