Bitget said that unauthorized transfers began on September 24 at 18:31 UTC and affected part of the exchange’s hot and intermediate wallets. Cold wallets, where assets are stored without a constant internet connection, were not affected, according to the company.
Withdrawals were temporarily suspended, but trading continues to operate. Later, Bitget separately warned of delays in crediting some cryptocurrency deposits.
The company claims that the losses are fully covered by its user protection fund, which exceeds $464 million. Bitget promised to publish a full report on the causes of the hack and the measures taken within 24 hours after the attack.
Gracy Chen wrote on X that the preliminary investigation identified IP addresses and VPN services similar to those used by North Korean hackers in previous operations. According to her, involvement by a DPRK group is highly likely, but there is still no definitive attribution.
In terms of the scale of losses, the attack on Bitget became the largest confirmed crypto theft since the beginning of 2026. Before that, the largest were considered the April attacks on KelpDAO and Drift Protocol, in which about $292 million and $285 million were stolen, respectively; the analytics company TRM Labs linked both operations to North Korean hackers and estimated the share of DPRK-related groups by the end of April at about 76% of all money stolen in crypto hacks since the beginning of the year.
At the same time, the current hack did not become the largest crypto theft in history: in February 2025, about $1.46 billion in Ethereum was stolen from the Bybit exchange, and the FBI later linked that attack to the North Korean group Lazarus, which U.S. authorities also call TraderTraitor.
Sources
