Bitget Points to North Korea After $350 Million Hack
Bitget says the attack went through a backend system and not the wallets themselves. XRP was the biggest stolen asset, while the investigation into DPRK involvement continues.
Key Takeaways
- Bitget says North Korea is very likely responsible for the $350 million hack.
- Attackers abused a backend system without getting private keys or direct access to wallets.
- Bitget says its User Protection Fund can cover the losses and will publish a technical report later.
Bitget says North Korea is “very likely” behind the hack of $350 million (€308 million). According to CEO Gracy Chen, the attackers did not get their hands on private keys, but they did manage to abuse a backend system to siphon off funds. Withdrawals remain paused for now after the September 24 attack.
Trail to DPRK
Chen said during a live Q&A on X that the team had found IP addresses matching VPN choices used by a group from the Democratic People's Republic of Korea, or the DPRK. Based on that, Bitget sees North Korean involvement as very likely. She did not name a specific group.
That suspicion fits a broader pattern. North Korean hacking groups, including Lazarus, have been linked to major crypto thefts for years. In April 2026, the Lazarus Group was also tied to the hack of Kelp DAO, where about $290 million (€255 million) was stolen through LayerZero.
How the Attack Worked
According to Chen, Bitget's hot, warm, and cold wallets were not directly compromised. The attackers also did not submit fake withdrawal transactions from users. Instead, they gained access to a critical backend system inside the wallet infrastructure, which let them spoof transaction data and trick the authorization process.
The exchange says the damage has been contained and that no further unauthorized transfers can happen. Lookonchain reported that the attackers took nine different assets. XRP made up by far the biggest share, with about 102.9 million tokens worth roughly $157.5 million (€139 million).
Bitget says its User Protection Fund, now above $464 million (€408 million), can cover the full loss. That matters for users because it shows how exchanges try to protect trust and liquidity after a major hack while the investigation is still ongoing.
A similar mix of wallet and infrastructure risks also showed up in other recent incidents. For example, Bitget previously reported large suspicious transfers after users reported withdrawal problems.
Biggest Hack of 2026
According to DefiLlama, this is so far the biggest crypto hack of 2026. The Bitget attack is larger than the incident at Liquid Network in September and the attack on Drift in April. The tracker puts total losses this year at about $2.2 billion (€1.9 billion) across 281 incidents.
Chen has promised to publish a full technical report later, once investigators have further confirmed the breach. That report should make clear whether the forensic evidence supports the North Korea attribution.
