Bitget said losses from its latest security breach have reached roughly $387.5 million, making it what is believed to be the biggest crypto hack of the year. The exchange said law enforcement is investigating, and while North Korea has emerged as a leading line of suspicion, the attacker has not been confirmed.
How the breach unfolded
According to the exchange, Bitget’s security systems detected unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24. Within about an hour, on-chain investigators had already counted roughly $183 million in stablecoins, Ethereum, and other crypto assets leaving wallets tagged as belonging to the exchange.
By the time Bitget publicly confirmed the incident hours later, the loss estimate had increased to $351.6 million. On September 25, the company updated that figure again, putting total losses at about $387.5 million.
Bitget CEO Gracy Chen addressed the incident in a livestream and a series of posts on X. She said the attackers 「did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet」. Instead, she said, the attackers compromised a backend system within Bitget’s wallet infrastructure and used it to spoof transaction data, tricking the exchange’s internal authorization process into approving payouts that looked normal.
The account she gave points to a manipulation of internal transaction handling rather than a direct theft of key material. In effect, the system signed off on fraudulent transfers because the requests appeared legitimate inside the exchange’s own workflow.
Early on-chain clues
Blockchain researchers had begun piecing together the activity before Bitget made any public statement. Pseudonymous researcher DCF GOD flagged a newly created wallet that used $19.67 million in USDT0, a cross-chain version of Tether’s dollar-pegged stablecoin, to buy 7,111 ETH in six minutes. The trades were executed through UniswapX and 1inch Fusion at roughly 5% above market price.
「Within 24 hours of the September 24 (UTC) incident: here is our further update as promised. Our investigation with Mandiant and SlowMist is ongoing — thorough forensic analysis takes more than 24 hours, and further findings will be shared as they become available. Three key…」
Additional wallets tagged as Bitget then sent assets across at least five blockchains to addresses controlled by the attacker. The largest single part of the stolen funds was roughly 103 million XRP, worth about $157 million.
What Bitget says happens next
Chen said the outflow has since been stopped and that no further unauthorized transfers are possible. She also said Bitget’s user protection fund, which holds more than $464 million, will absorb the full loss, leaving customer account balances unaffected even though the assets themselves have been stolen.
Deposits and trading continued throughout the incident response. Withdrawals alone were paused as a precaution.
Decrypt’s report noted that Bitget established the protection fund years ago with scenarios like this in mind. In 2023, the fund stood at $300 million and was earmarked specifically to cover hack- and theft-related losses so customers would not bear the damage.
Why North Korea is being mentioned
On attribution, Chen pointed toward Pyongyang, though carefully. She said, 「We’ve identified some IP addresses that match the VPN choices by a certain DPRK group,」 and added that 「the pattern looks very much like what the North Korean team did before.」
She also said the on-chain signatures align with techniques associated with North Korean state-linked hacking groups, while stressing that the attacker’s identity has not been confirmed and that no technical evidence has been released publicly.
Chen added that she had personally been targeted by the same group before and lost about $80,000 from a personal wallet outside Bitget.
Context and pending report
North Korea’s Lazarus Group, also tracked under the codename TraderTraitor, has been blamed for some of the industry’s biggest thefts. The report cited the $1.4 billion Bybit hack in February 2025, which the FBI confirmed weeks later was the work of North Korea. Blockchain analytics firm Chainalysis has estimated that the country’s 2025 haul exceeded $2 billion.
Bitget said it will publish a full incident report, including a root-cause analysis, after its technical teams complete system remediation. Withdrawals remain paused for now, and the exchange said it will announce a plan tomorrow for users who want to withdraw funds.