North Korea-Linked Hackers Blamed for $387.5 Million Bitget Crypto Theft

A major cryptocurrency theft initially reported at about $351.6 million has grown into one of the biggest cybercrime stories of 2026, with blockchain analytics firm Chainalysis attributing the attack on crypto exchange Bitget to North Korea-linked threat actors.

Bitget detected unauthorized transfers from some of its hot and warm wallets at 18:31 UTC on September 24, 2026.

The exchange initially estimated that approximately $351.6 million in digital assets had been affected — the figure cited in early media reports, including Dawn.

Bitget later revised the amount upward to $387.5 million after completing a broader accounting of assets moved across several blockchain networks.

Then, on October 1, Chainalysis said its investigation attributed the theft to DPRK-linked actors and reported that the incident pushed cryptocurrency stolen by North Korean-linked hackers during 2026 to more than $1 billion.

The case adds to growing international concern over North Korea’s use of cyber operations, cryptocurrency theft and fraudulent overseas IT workers to generate revenue while operating under extensive international sanctions.

Bitget Initially Reported $351.6 Million Missing

Bitget’s first public security notice said unauthorized transfers had affected part of its hot-wallet infrastructure.

The exchange estimated the loss at approximately $351.6 million.

It stressed that its cold wallets — where a large proportion of customer assets were stored — had not been compromised.

Bitget also said customer balances remained protected through its user protection arrangements.

That initial figure became the basis for early reporting on the incident.

Dawn’s September 28 report accordingly said Bitget suspected North Korean hackers could be responsible for a breach affecting about $351.6 million.

But subsequent investigation produced a larger figure.

Bitget Revised the Loss to $387.5 Million

Bitget’s official incident timeline now places the confirmed affected amount at approximately:

$387.5 million

The company said the revision reflected a more complete accounting of transfers involving additional assets and networks, including Zcash and Tron.

It explicitly said the increase did not represent another attack or additional unauthorized transfers after the initial incident.

The earlier $351.6 million figure should therefore now be treated as an initial estimate rather than the final reported loss.

That is an important correction for articles based on reporting published immediately after the breach.

What Happened to Bitget?

According to Bitget’s subsequent investigation, the attackers did not steal the exchange’s private keys.

Instead, Bitget says the attackers exploited a vulnerability involving a third-party security product.

The compromise allegedly allowed them to obtain internal access credentials.

Those credentials were then used to create fraudulent withdrawal commands that were accepted by Bitget’s wallet infrastructure, allowing abnormal transfers to bypass existing risk controls.

Bitget says:

The vulnerability has been patched.
Private keys were not compromised.
Cold wallets were unaffected.
The incident was contained.
No additional unauthorized transfers have occurred.

Independent cybersecurity companies Mandiant, part of Google Cloud, and SlowMist subsequently reviewed the incident.

Bitget says both investigations broadly confirmed the attack path involving compromised third-party security technology and unauthorized access to its wallet environment.

Which Assets Were Stolen?

The incident affected multiple digital assets across several blockchain networks.

Bitget lists affected assets including:

ETH
XRP
USDT
USDC
ZEC
TRX
BNB
AVAX
XAUt
USDT0

The affected transfers moved across networks including Ethereum and other EVM-compatible chains, XRP Ledger, Zcash and Tron.

The multi-chain nature of the attack created a major tracing challenge because stolen funds could be moved rapidly between assets, networks and services.

Chainalysis Attributes the Attack to North Korea

The most significant development came on October 1.

Chainalysis published an investigation stating that DPRK-attributed threat actors stole approximately $387 million from Bitget on September 24.

According to its analysis, the stolen funds were moved rapidly after the breach.

Within about three hours, the assets had been distributed across four major blockchain environments.

Chainalysis estimated the initial distribution as:

Ethereum — 49.7%
XRP — 40.8%
Zcash — 7.6%
Tron — 1.8%

The attackers then began using different mechanisms to move and obscure the funds.

These reportedly included:

Blockchain bridges
Decentralized exchanges
Instant swaps
Cross-chain protocols
Laundering services

Important Attribution Caveat

The attribution needs to be stated precisely.

Chainalysis has attributed the Bitget attack to DPRK-linked actors.

Bitget’s own official incident pages confirm the hack, attack mechanism and financial loss but do not currently identify North Korea as the attacker.

Likewise, the available FBI material independently confirms North Korean responsibility for previous major cryptocurrency attacks such as the 2025 Bybit breach, but an equivalent FBI public attribution for the September 2026 Bitget incident was not located during Info-Matix’s review.

Therefore, it would be premature to write that every relevant government authority has formally attributed Bitget’s breach to Pyongyang.

The more accurate formulation is:

Blockchain analytics firm Chainalysis attributes the Bitget theft to DPRK-linked threat actors.

North Korean-Attributed Crypto Theft Has Passed $1 Billion in 2026

Chainalysis says the Bitget attack pushed the total value stolen by North Korean-linked crypto hackers in 2026 above $1 billion.

That follows an even larger year in 2025.

According to Chainalysis, DPRK-linked hackers stole about $2.02 billion in cryptocurrency during 2025, bringing its lower-bound historical estimate of North Korean crypto theft to approximately $6.75 billion by the end of that year.

Those figures are estimates produced from identified blockchain activity.

Chainalysis itself cautions that crypto-crime estimates can increase over time as investigators identify additional addresses and attribute earlier transactions.

The $1.5 Billion Bybit Hack Changed the Scale of the Threat

North Korea’s most prominent recent crypto attack occurred in February 2025.

The FBI formally attributed the theft of approximately $1.5 billion in virtual assets from cryptocurrency exchange Bybit to North Korea.

The FBI calls the associated malicious activity TraderTraitor.

After the theft, the FBI said attackers quickly converted part of the stolen assets into Bitcoin and other cryptocurrencies and distributed funds across thousands of blockchain addresses.

The agency expected those assets to be further laundered and eventually converted into fiat currency.

That attack remains an important benchmark because it demonstrated that a single successful intrusion could generate more than a billion dollars.

How North Korean Hackers Operate

North Korean-linked cyber operations are not limited to finding technical vulnerabilities in cryptocurrency code.

Investigators increasingly describe a combination of:

Social engineering
Fake employment identities
Malicious job interviews
Impersonation
Insider access
Compromised third-party software
Cryptocurrency laundering
Malware
Credential theft

Chainalysis says North Korean operators increasingly attempt to embed IT workers inside cryptocurrency companies and Web3 businesses, providing privileged access that could facilitate larger compromises.

This makes employee verification and internal-access controls increasingly important parts of crypto cybersecurity.

Fake IT Workers Are Another Major Revenue Source

Cryptocurrency theft is only one component of the issue.

The US Treasury Department sanctioned six individuals and two entities in March 2026 over alleged involvement in North Korean government-directed IT worker operations.

Treasury said these schemes use stolen identities, false documentation and fabricated personas to obtain remote employment at legitimate companies.

It said North Korean IT worker schemes generated nearly $800 million during 2024, which the US government says supports Pyongyang’s weapons programmes.

This does not mean every North Korean IT worker is directly involved in crypto hacking.

Rather, authorities describe cyber theft and fraudulent employment as separate but overlapping revenue-generation strategies.

Why Governments Link Crypto Theft to North Korea’s Weapons Programmes

A group of 11 countries participating in the Multilateral Sanctions Monitoring Team has published findings linking DPRK cybercrime, cryptocurrency theft and fraudulent IT employment with revenue generation for North Korea’s nuclear and ballistic-missile programmes.

US Treasury has similarly stated that North Korea has used cyber theft and crypto laundering to generate revenue for programmes restricted under international sanctions.

These are assessments by participating governments and authorities.

North Korea has rejected broader US-led allegations about its cyber activity, describing such accusations as attempts to damage its reputation and exert political pressure. That general rejection was reported by Reuters in August 2026; it was not specifically a response to the Bitget incident.

Laundering the Crypto Is Almost as Important as Stealing It

Stealing hundreds of millions of dollars in cryptocurrency does not automatically give an attacker usable cash.

Blockchain transactions are publicly visible on many major networks.

The attacker therefore has to move the stolen assets while attempting to prevent exchanges and investigators from identifying and freezing them.

Common laundering techniques can involve:

Splitting large transfers into smaller ones
Swapping one cryptocurrency for another
Moving between blockchains
Using mixers
Using decentralized exchanges
Routing funds through intermediaries
Working with over-the-counter brokers

Chainalysis says DPRK-linked actors use distinctive laundering patterns and have relied on professional money-laundering networks, including Chinese-language services and OTC traders.

Authorities Are Targeting Laundering Infrastructure

Law enforcement efforts increasingly focus not only on the hackers themselves but also on businesses and networks that help turn stolen cryptocurrency into spendable assets.

In September 2026, US authorities moved against Xinbi Guarantee, described as a Chinese-language marketplace connecting criminal networks with laundering and other illicit services.

Chainalysis says DPRK-linked actors moved tens of millions of dollars connected to major hacks, including Bybit and WazirX, through vendors operating in the Xinbi ecosystem.

US authorities sanctioned associated entities and targeted cryptocurrency wallets connected with the network.

The strategy illustrates one of the main weaknesses attackers face: stolen digital assets may be easy to transfer, but cashing them out at scale can leave identifiable points of contact with financial services.

Blockchain Transparency Can Help Investigators

Cryptocurrency is sometimes portrayed as impossible to trace.

That is not generally accurate.

Many blockchains contain permanent public transaction histories.

Investigators may not immediately know who controls a wallet, but they can follow transactions and identify interactions with exchanges, bridges and other services.

Chainalysis says it used automated tools and artificial intelligence during the Bitget investigation to accelerate analysis of movements across different chains.

In one example, it said work that could have required more than 20 hours of manual reconciliation was reduced to under 10 minutes.

Human investigators still reviewed and interpreted the results.

Can the Stolen Money Be Recovered?

Potentially, but recovery is difficult.

Cryptocurrency can sometimes be frozen when it reaches a cooperating centralized exchange or stablecoin issuer.

Exchanges can blacklist addresses.

Authorities can also seize cryptocurrency when they obtain control of wallets or infrastructure connected with criminal networks.

But recovery becomes more difficult when attackers successfully:

Convert assets repeatedly
Use decentralized protocols
Move across several blockchains
Exchange funds through illicit OTC networks
Convert crypto into fiat currency

Bitget has announced a tracing and recovery programme and is working with external cybersecurity specialists and other industry participants.

The final amount ultimately recovered remains unknown.

Bitget Says Customer Funds Remain Fully Backed

Bitget has repeatedly said that its customers are not being asked to absorb the loss.

Its initial security notice said the company’s User Protection Fund exceeded $464 million, enough at the time to cover the estimated incident.

After the breach, Bitget published updated Proof of Reserves and stated that customer assets remained backed 1:1.

Proof of reserves can provide transparency about assets controlled by an exchange, although it should not automatically be treated as equivalent to a complete financial audit covering all liabilities and corporate risks.

Hot Wallets Carry Greater Security Risk

The Bitget incident also highlights the difference between hot and cold wallets.

Hot wallets

These remain connected to online systems so exchanges can process withdrawals quickly.

That convenience creates a larger attack surface.

Cold wallets

These are kept offline or in significantly more isolated environments.

They are less convenient for everyday withdrawals but generally harder for remote attackers to compromise.

Bitget says the September attack affected hot and warm wallet infrastructure while its cold wallets remained secure.

For exchanges, the challenge is maintaining enough online liquidity to operate efficiently without exposing an unnecessarily large amount of customer assets.

What Crypto Exchanges Can Learn From the Attack

The incident is another reminder that the security of an exchange depends on more than its own code.

Bitget says attackers exploited a vulnerability associated with a third-party security product.

That means cybersecurity controls have to extend into the wider software supply chain.

Important protections can include:

Limiting privileged credentials
Multi-person approval for large withdrawals
Segmentation of wallet systems
Behavioural monitoring
Withdrawal velocity limits
Third-party security audits
Cold-storage limits
Employee identity verification
Continuous monitoring of access credentials

Even strong internal systems can be undermined when a trusted external component is compromised.

What Individual Crypto Users Can Do

Ordinary users cannot prevent an exchange’s infrastructure from being hacked.

But they can reduce their personal exposure.

Useful precautions include:

Enable strong two-factor authentication.
Use unique passwords.
Never share seed phrases.
Verify withdrawal addresses carefully.
Be suspicious of fake support staff.
Avoid installing software sent through unsolicited messages.
Consider self-custody for assets that do not need to remain on an exchange.

Self-custody introduces its own risks.

A person who loses a private key or recovery phrase may permanently lose access to the cryptocurrency.

There is therefore no completely risk-free custody method.

Important Correction to the Original Report

Dawn’s September 28 item reported that:

Bitget suspected North Korean hackers may have been responsible for a breach involving around $351.6 million.

That was accurate based on information available at the time.

Several important developments have occurred since then.

First: Bitget revised the confirmed loss to $387.5 million.

Second: independent cybersecurity investigations confirmed a breach involving a compromised third-party security product.

Third: Chainalysis publicly attributed the theft to DPRK-linked actors on October 1.

The updated Info-Matix article should therefore use the newer $387.5 million figure rather than continuing to repeat $351.6 million.

Bottom Line

The September 24 attack on cryptocurrency exchange Bitget is now estimated to have affected approximately $387.5 million in digital assets, substantially more than the initial $351.6 million estimate cited in early reports.

Bitget says attackers exploited a vulnerability involving a third-party security product to obtain internal credentials and generate fraudulent withdrawal commands. Private keys and cold wallets were not compromised, according to the exchange, and independent investigations by Mandiant and SlowMist broadly supported its technical account of the breach.

On October 1, blockchain analytics firm Chainalysis attributed the attack to North Korea-linked threat actors and said the theft pushed DPRK-attributed cryptocurrency stealing above $1 billion in 2026.

That follows approximately $2.02 billion attributed to North Korean hackers during 2025, according to Chainalysis.

North Korea has previously rejected broader US-led allegations about its cyber operations, and no specific public North Korean response to the Bitget attribution was located during Info-Matix’s review.

The Bitget case ultimately highlights two increasingly important cybersecurity realities: cryptocurrency exchanges remain attractive targets because a successful breach can produce enormous returns, and identifying the attacker is only the beginning — tracing and preventing the laundering of hundreds of millions of dollars across multiple blockchains can become an equally difficult part of the investigation.