Bitget CEO Gracy Chen said North Korean hackers were "very likely" responsible for a $350 million breach of the exchange. During a live Q&A on X following the September 24 incident, Chen pointed to evidence linking the attack to the Democratic People's Republic of Korea.
"We've identified some IP addresses that match the VPN choices by a certain DPRK group," Chen stated, though she did not name the specific group.
How the Attack Occurred
Chen explained that attackers never obtained private keys for Bitget's hot, warm, or cold wallets. Instead, they compromised a critical backend system within the wallet infrastructure, spoofed transaction data, and triggered the authorization process to move funds.
The stolen assets included nine different cryptocurrencies, with XRP representing the largest portion at approximately 102.9 million tokens worth roughly $157.5 million. On-chain analyst Specter linked the stolen XRP to funds from the AFX Trade exploit, which lost $24 million in July and was attributed to TraderTraitor, a unit linked to Lazarus.
Largest Hack of 2026
DefiLlama data ranks the Bitget breach as the largest crypto hack of 2026. It surpassed Liquid Network's $320 million incident and the $295 million Drift breach, both occurring earlier in the year. The incident made September the costliest month of 2026 for crypto hacks to date.
According to TRM Labs, North Korean groups accounted for 76% of crypto hack losses through April 2026, primarily through the Drift and Kelp attacks. In 2025, Lazarus carried out the $1.5 billion Bybit hack, the year's largest incident.
User Protections and Response
Bitget said the breach is contained and no further unauthorized transfers can occur. The exchange's User Protection Fund, which now exceeds $464 million, covers the full loss. Bitget launched the fund in 2022 and has committed to maintaining it above $300 million.
Withdrawals remain suspended following the breach. Chen promised a full technical report once investigators confirm the intrusion method and provide forensic evidence backing the North Korea attribution.
