Bitget hit by $352 million hack with North Korea suspected
The crypto theft may rank among the largest in 2026.
Image by Cybernews.
- Bitget says hackers stole almost $352 million from one hot wallet.
- The exchange says user funds are safe and cold wallets remain secure.
- Bitget suspects North Korean criminals, but some analysts dispute a direct Lazarus Group link.
- Withdrawals are suspended as a precaution, while deposits and trading still work.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Major crypto exchange Bitget has confirmed that it lost almost $352 million in a hack on September 24th, suspecting North Korean criminals were behind the attack.
The company said the breach affected one of its so-called hot wallets, while user funds are safe. It also claimed that the lost funds are smaller than the $464 million Bitget's User Protection Fund, while its proprietary assets exceed $1 billion.
Hot wallets refer to programs designed to store private keys to crypto assets. These types of wallets are connected to the internet. Bitget said that its cold wallets, or special hardware for storing private keys offline, "remain fully secure."
Per its CEO, Gracy Chen, the biggest stolen amount is in the XRP token, while ethereum, BNB, USDT, USDC and other assets have also been stolen. According to the CEO, some of the unspecified foundations behind these assets have confirmed the freezing of hacker wallet addresses.
"Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations," Chen said, promising that a full incident report would be published within 24 hours.
Blockchain investigator, known on X as @SpecterAnalyst, claims that the North Korean Lazarus Group is behind the hack.
"Just linked this hack to the AFX hack, which stole $24M in July and was specifically attributed to TraderTraitor. The stolen XRP from Bitget was bridged and can be directly linked to the funds stolen in the AFX hack," they said.
However, some other commenters pointed out that while this is a similar laundering style, this is not Lazarus, which is often blamed for all kinds of crypto hacks.
Earlier in September, a prominent on-chain analyst, known as @tanuki42_ on X, emphasized that "the word "Lazarus" doesn't mean anything anymore."
"It's just a collective name used to describe various North Korean cyber operations," they said.
In either case, at the time of writing, Bitget users can't withdraw their funds from the exchange because withdrawals were suspended as a "precautionary measure."
However, users can still deposit funds and trade on the platform.
According to CoinGecko.com data, Bitget is ranked sixth by trading volume ($1.17 billion) over the past 24 hours among centralized crypto exchanges.
