$387 MILLION VANISHES IN CRYPTO HACK: DO DIGITAL CLUES POINT TO NORTH KOREA?
Oct 01, 2026
One of the biggest cryptocurrency thefts of 2026 has hit crypto exchange Bitget, with attackers making off with approximately $387.5 million in digital assets.
The attack was detected on September 24 after Bitget noticed unauthorized transfers from several of its hot and warm wallets. The stolen assets included ETH, XRP, USDT, USDC, BNB, AVAX, Zcash and other cryptocurrencies spread across multiple blockchain networks. Bitget initially estimated the damage at $351.6 million, but later increased the figure after investigators identified additional affected assets.
Attention quickly turned toward North Korea. Bitget CEO Gracy Chen said the attack showed patterns associated with previous North Korean operations. Investigators reportedly identified suspicious network behavior and on-chain activity resembling techniques previously connected to North Korean state-backed hackers. However, the attribution remains an investigative assessment rather than a publicly proven conclusion.
Bitget's investigation indicates that the attackers exploited a vulnerability in third-party security software to obtain high-level internal credentials. Those credentials were then allegedly used to create fraudulent withdrawal instructions that appeared legitimate to the exchange's wallet infrastructure. Importantly, Bitget says its private keys and cold wallets were not compromised.
Once the cryptocurrency was stolen, some assets were rapidly converted and distributed across different addresses, making attempts to freeze and recover the money considerably more difficult. Blockchain investigators, cybersecurity firms and law enforcement are now tracing the funds.
Bitget says customer balances remain protected and that its $464 million-plus User Protection Fund is sufficient to cover the financial impact of the attack. Withdrawals were temporarily suspended and have since begun returning in phases.
If North Korean involvement is ultimately confirmed, the attack would add to a growing list of massive cryptocurrency thefts attributed to groups associated with Pyongyang. For now, the blockchain provides investigators with an unusually public trail of where hundreds of millions of dollars went — but discovering exactly who was behind the keyboards remains the harder part.
The attack was detected on September 24 after Bitget noticed unauthorized transfers from several of its hot and warm wallets. The stolen assets included ETH, XRP, USDT, USDC, BNB, AVAX, Zcash and other cryptocurrencies spread across multiple blockchain networks. Bitget initially estimated the damage at $351.6 million, but later increased the figure after investigators identified additional affected assets.
Attention quickly turned toward North Korea. Bitget CEO Gracy Chen said the attack showed patterns associated with previous North Korean operations. Investigators reportedly identified suspicious network behavior and on-chain activity resembling techniques previously connected to North Korean state-backed hackers. However, the attribution remains an investigative assessment rather than a publicly proven conclusion.
Bitget's investigation indicates that the attackers exploited a vulnerability in third-party security software to obtain high-level internal credentials. Those credentials were then allegedly used to create fraudulent withdrawal instructions that appeared legitimate to the exchange's wallet infrastructure. Importantly, Bitget says its private keys and cold wallets were not compromised.
Once the cryptocurrency was stolen, some assets were rapidly converted and distributed across different addresses, making attempts to freeze and recover the money considerably more difficult. Blockchain investigators, cybersecurity firms and law enforcement are now tracing the funds.
Bitget says customer balances remain protected and that its $464 million-plus User Protection Fund is sufficient to cover the financial impact of the attack. Withdrawals were temporarily suspended and have since begun returning in phases.
If North Korean involvement is ultimately confirmed, the attack would add to a growing list of massive cryptocurrency thefts attributed to groups associated with Pyongyang. For now, the blockchain provides investigators with an unusually public trail of where hundreds of millions of dollars went — but discovering exactly who was behind the keyboards remains the harder part.