- Bitget says an attacker broke into a backend wallet system, fed it falsified data, and triggered its own authorization process, moving about $390 million; the first figure was $351.6 million.
- Bitget and outside firms Elliptic and TRM Labs link the theft to North Korean groups, but this is not a confirmed finding, and how the attacker got in is undisclosed.
- Organisations that approve payments automatically should check that approvals verify details independently of the backend supplying them, limit funds in accessible accounts, and test a plan to suspend transfers.
What Bitget has disclosed
Bitget, a cryptocurrency exchange, has attributed a $351.6 million theft from its hot and warm wallets to suspected North Korean threat actors, according to a report from The Hacker News. The exchange disclosed on X that its security systems flagged the unauthorized transfers at 18:31 UTC on September 24, 2026. According to Bitget, its cold storage and the large majority of platform assets were untouched, and customer balances shown on the platform remained accurate.
That initial figure has since grown. A subsequent post on X revised the total: after further on-chain tracing and transaction classification, Bitget put the value moved into attacker-controlled wallets across several networks at approximately $390.06 million.
For any organisation that authorises payments, the mechanism matters more than the total. Chief executive Gracy Chen described how the attack worked: an intruder broke into a critical backend system inside the wallet infrastructure, fed it falsified transaction data, and used that to set off the exchange's own authorization workflow, which then released the funds. Chen's description implies the authorization process acted on falsified data. Bitget has not said whether the process itself functioned as intended. It has said the vulnerability involved has been identified and addressed. It has not disclosed how the intrusion occurred, and said the method remains under active investigation.
Scope, attribution and response
The tokens involved include ETH, XRP, BNB, AVAX, USDT and USDC, according to Chen, spread across seven networks: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. Bitget says Bitget Wallet, a self-custodial product on separate infrastructure from the exchange, was not affected.
Attribution rests on Bitget and outside analytics firms, not on a confirmed finding. Chen said IP behavior patterns and on-chain analysis are highly consistent with known North Korean groups. Elliptic reported connections between stolen Bitget funds and addresses used to launder earlier DPRK-attributed exploits, including the 2025 Bybit theft. TRM Labs found overlaps with wallets used to launder the Bybit and AFX Bridge proceeds and said they point to the TraderTraitor group. The Hacker News noted TraderTraitor is best known for the $1.5 billion Bybit theft and the $292 million KelpDAO LayerZero bridge theft.
To investigate independently, Bitget brought in Mandiant and SlowMist and reached out to the foundations behind each affected blockchain. Some have confirmed freezing hacker wallet addresses. The exchange has also launched a Recovery Bounty Program. Withdrawals were suspended and are due to resume in phases from September 28, 2026 at 8 a.m. UTC.
What a budget-holder should ask their team
Bitget's account describes falsified data flowing from a compromised internal system into its approval process. How the attacker got in has not been disclosed. The questions below apply to any organisation that moves money or grants access through automated approvals.
First, does our authorization process verify transaction details independently of the backend system that supplies them, or does it accept upstream data as given? Second, which internal systems can write to the data our approvers rely on, and who has tested what happens if one of them is compromised? Third, what limits apply to funds held in operationally accessible accounts, compared with those held under stricter controls? Bitget's cold wallets were reported unaffected. Fourth, do we have an incident retainer and a tested plan for suspending outbound transfers while a review runs? Bitget paused withdrawals during its investigation. Finally, which of our payment and identity systems are separated from each other, and has that separation been tested rather than assumed?
The intrusion method is not yet public. These questions do not depend on it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Hacker News.
