Bitget Hack Loss Climbs to $387 Million; North Korea Suspected
Bitget's confirmed security loss has risen to $387.5 million after further investigation revealed the attacker used forged internal transfer requests to drain hot and warm wallets. The exchange's CEO says the attack's fingerprints resemble tactics attributed to North Korean threat actors.
Written by CoinArticle’s AI Newsroom · from 6 cited sources. How we work
Story Updates
- Updated Sep 25, 2026, 11:05 PM: ZyCrypto confirms CEO attribution statement; loss figure and attack method details remain consistent with prior reporting.
- Updated Sep 25, 2026, 08:01 PM: Loss figure revised to $387.5M; attack method identified as forged internal transfers; North Korea attribution reported.
- Updated Sep 25, 2026, 05:10 AM: Bitget clarifies that cold wallets holding majority of user assets were never compromised in the breach.
- Updated Sep 25, 2026, 05:06 AM: Bitget identifies backend system compromise as likely source; withdrawals paused as investigation continues.
Updated Loss Figure and Attack Method
Bitget's total confirmed loss from the breach has climbed to $387.5 million, up from the initially reported $351.6 million, according to Decrypt and ZyCrypto reporting. Investigation revealed the attacker did not exploit a protocol vulnerability but instead fabricated internal transfer requests to move funds out of hot and warm wallet layers. The forged requests suggest the attacker obtained sufficient access to Bitget's wallet authorization systems to impersonate legitimate internal transactions.
North Korea Attribution Signals
Bitget CEO Gracy Chen stated that the breach's "fingerprints" resemble tactics and tools associated with North Korean-linked threat actors. The company has not released forensic evidence supporting the attribution, and independent security researchers have not yet publicly corroborated the assessment. North Korean hacking units, including those monitored by the U.S. Treasury and security firms, have historically targeted cryptocurrency exchanges to fund state operations.
Cold Wallet Segregation Held
Bitget maintains that cold wallets holding the majority of user assets remained untouched throughout the breach. The company has paused withdrawals pending the investigation and has not yet announced compensation mechanisms, insurance coverage, a detailed technical breakdown of the backend compromise, or a timeline for restoring normal operations. User fund security remains contingent on the integrity of those offline reserves.
Operational Questions Persist
The scale of the loss and the speed of execution—completed in under an hour—underscore the risk posed by hot wallet authorization infrastructure. The use of forged internal requests rather than direct key compromise raises questions about Bitget's transaction approval workflows and how many layers of human or automated review separated wallet movement requests from execution. The breach highlights the structural tension between operational speed and custody security at centralized exchanges.
Why It Matters
For Traders
Withdrawal suspension persists with no timeline disclosed; liquidity risk extends across affected account balances pending investigation completion.
For Investors
A $387.5M state-sponsored attack on exchange infrastructure raises systemic counterparty risk and signals escalating geopolitical targeting of crypto custodians.
For Builders
Forged-request compromise underscores need for cryptographic proof-of-transaction mechanisms independent of operator-controlled authorization layers in custody systems.
This article is for information only and is not financial advice. Read the full disclaimer.
