North Korea Loots Bitget

Article by Nacata Security, 25/09/2026

Did you know an exchange can lose millions in hours without anyone noticing?

Bitget just confirmed it: $351.6 million stolen in a single night.

The platform’s security systems detected unauthorized transfers from a limited number of wallets, but the damage was done before they could react.

Most unsettling is that the attackers didn’t force any visible door: they compromised the internal authorization system and turned it against the platform.

The attack was neither a lucky strike nor an isolated mistake.

The hackers gained access to a critical system within Bitget’s wallet infrastructure. From there, they forged transaction data and triggered the authorization signing process as if they were legitimate operations. The funds were distributed across multiple blockchains: Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base, affecting assets such as ETH, XRP, BNB, AVAX, USDT, and USDC.

The largest individual loss: a single chain, XRP.

Mandiant and SlowMist joined the analysis alongside law enforcement agencies and on-chain security institutions. Bitget suspended all withdrawals as a precautionary measure. CEO Gracy Chen confirmed that some blockchains have already frozen the attackers’ addresses, limiting their ability to move part of the haul, although the bulk of the damage is already done.

IP patterns and on-chain tracing point to organized North Korean hackers.

Chen confirmed it: IP analysis and on-chain tracing show high consistency with methods used by known North Korean organizations. The platform reported the case to the relevant authorities and is cooperating in a global investigation. Cold wallets and the majority of assets remain intact.

The user fund absorbs the blow.

Bitget’s User Protection Fund exceeds $464 million, enough to cover the losses. Balances have not been altered and trading continues to operate normally. But the question hanging in the air is more uncomfortable than the theft itself.

This is not the first North Korean heist.

A few months ago, the same attacker profile was linked to the $1.5 billion theft from Bybit, the largest crypto heist in history at the time. The pattern repeats: access to internal wallet systems, data forgery, and fraudulent activation of the authorization process. This is not a public exploit: it is a surgical infiltration into the internal logic of the platforms.

North Korea has turned crypto theft into a state industry.

Regime-linked groups have spent years accumulating funds through attacks on exchanges, DeFi protocols, and cross-chain bridges. Analysts estimate these thefts directly fund weapons programs. This is not opportunistic cybercrime: it is an economic strategy to circumvent international sanctions and sustain the regime.

The question no one wants to answer: how exactly did they get in?

Bitget acknowledges that the specific method of intrusion remains under active investigation. That means that, for now, even they don’t know with certainty what initial failure opened the door. That uncertainty is, in itself, a warning signal for the entire sector.

The entry vector remains an open mystery.

As the investigation progresses, other platforms should review their internal authorization systems. If the attackers compromised the wallet backend without leaving an immediate trace, nothing guarantees that this method cannot be replicated on another exchange with a similar architecture. The threat does not disappear when the case is closed.

The theft is over, the threat is not.

North Korea is not going to stop. And as long as the exact method of intrusion remains unanswered, the entire crypto sector should be looking over its shoulder.

How much do you really trust that your exchange would survive an attack like this?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime