Part of: Chainalysis links $387 million Bitget hack to North Korean actors·3 events

North Korea suspected in $387.5 million Bitget crypto hack

September 28, 2026 at 05:00 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

North Korea is suspected of stealing over $387 million from crypto exchange Bitget in the largest hack of 2026. Bitget CEO Gracy Chen said the September 24 attack bore hallmarks of North Korean state-sponsored actors, citing IP addresses tied to VPN infrastructure previously used by North Korean hacker groups. The thieves swapped stablecoins for ETH within minutes to dodge freezes.

Key Facts

Bitget CEO Gracy Chen named North Korea as the primary suspect in the September 24 hack.
The final official stolen amount is $387.5 million, revised from an initial $351.6 million.
Stolen assets include Ether, XRP, USDT, USDC, Avalanche, and BNB across Ethereum, XRP Ledger, Avalanche, BSC, and Arbitrum networks.
Hackers exploited a backend wallet system by forging transfer approvals.
Cold wallets and private keys remained safe and uncompromised.

Attack Attribution

Bitget CEO Gracy Chen said during an X livestream on the evening of September 24 that the attack bore the hallmarks of North Korean state-sponsored threat actors. She cited suspicious IP addresses tied to VPN infrastructure previously used by North Korean hacker groups. The hack is the biggest crypto theft of 2026 so far.

Theft Mechanics

Bitget detected abnormal transfers from some hot wallets on Thursday afternoon Eastern time. The hackers exploited a backend wallet system that processes wallet transactions, forging transfer approvals that tricked the system into authorizing the fraudulent transactions. Cold wallets and private keys remained safe and uncompromised. The stolen assets include Ether, XRP, USDT, USDC, Avalanche, and BNB across the Ethereum, XRP Ledger, Avalanche, BSC, and Arbitrum networks.

Loss Assessment

Early independent on-chain analysis initially put the total stolen value at $170 million to $183 million. Bitget announced an initial official value of $351.6 million. Comprehensive audits revised the final official value to $387.5 million. The thieves swapped stablecoins for ETH within minutes to dodge freezes.