Bitget $352M Hack Used Fake Transfers as CEO Flags Likely North Korea Link

Points of Focus

• Attackers breached a critical Bitget wallet backend and spoofed transaction data to trigger unauthorized transfers.
• CEO Gracy Chen ruled out private-key compromise and said further unauthorized transfers had been contained.
• IP behavior and onchain analysis have led Bitget to investigate a possible North Korea link, though attribution remains unconfirmed.

Attackers behind Bitget’s $351.6 million breach manipulated transaction data inside a critical wallet backend, causing the exchange’s authorization system to approve unauthorized transfers, according to CEO Gracy Chen.

Bitget detected the activity at 18:31 UTC on Sept. 24. Its initial security notice placed the affected funds at approximately $351.6 million and identified part of the exchange’s hot and warm wallet infrastructure as compromised. Cold wallets remained secure.

Chen later identified ETH, XRP, BNB, AVAX, USDT and USDC among the affected assets, with XRP accounting for the largest single-chain loss. Seven networks were involved, including Ethereum, XRP Ledger and BSC. 

Attackers reached Bitget’s wallet backend

Chen traced the breach to a critical backend system supporting Bitget’s exchange wallet infrastructure. Investigators believe the intruders spoofed transaction data and triggered internal authorization controls, allowing funds to leave affected wallets.

刚才上午跟大家做了个三个多小时的直播，这里总结一下直播中聊到的点：

① Bitget 安全事件12小时进展通报。以下为具体信息，不打官腔。

②… https://t.co/kkVr4YbKZq

— Gracy Chen @Bitget (@GracyBitget) September 25, 2026

The exchange has ruled out private-key exposure, while Chen clarified that the attackers did not forge user withdrawal requests. Containment work has since stopped further unauthorized transfers as engineers continue reconstructing the initial intrusion path.

Bitget Wallet, the company’s decentralized wallet product, runs on separate infrastructure and was unaffected by the incident, according to Chen.

The breach follows other attacks targeting authorization and wallet controls. A $285 million Drift Protocol exploit involved compromised multisig approvals, while a Coldcard-linked theft was tied to weak seed generation.

Bitget probes possible North Korea connection

Bitget is investigating a possible North Korea link after IP behavior and onchain activity showed similarities with techniques associated with North Korean hacker groups. The findings have been reported to relevant authorities, though attribution remains unconfirmed.

Recovery efforts are underway. Bitget contacted foundations tied to the affected chains, with some confirming freezes of hacker-linked addresses. Stablecoin issuers can also freeze tokens at specific addresses, as seen when Circle froze 16 USDC-linked business wallets. 

Withdrawals remain suspended after the breach

Bitget has temporarily suspended withdrawals while the security review continues. Deposits and exchange trading remain operational, though Bitget Onchain trading has been temporarily affected.

The company’s protection fund holds 5,500 BTC, worth about $464 million at current prices. The fund would cover losses from the hot wallet incident following an assessment and would subsequently be replenished. 

A full incident report covering the root cause and corrective measures is due within 24 hours, according to Bitget.