Bitget hack attributed to North Korea after $387M theft

Bitget hack Chainalysis North Korea cryptocurrency theft blockchain security

Blockchain analytics firm Chainalysis has attributed a $387 million cryptocurrency theft from the Bitget exchange to North Korean-linked actors. The breach, which occurred on September 24, 2026, saw funds distributed across 23 transfers and four blockchains—primarily Ethereum and XRP—within just three hours.

Investigators utilized in-house AI and custom automation to trace the complex movement of assets, reducing the time required for cross-chain bridge reconciliation from over 20 hours to less than 10 minutes. The attackers reportedly used cross-chain liquidity protocols to swap stolen XRP for Bitcoin to obscure the trail.

Bitget's post-mortem investigation revealed that attackers had been inside the system for at least 24 days, having gained access by compromising two third-party security products. While the attackers did not steal private keys, they successfully fed fake transfer data into the backend to bypass signing processes.

Bitget CEO Gracy Chen stated that customer account balances were not affected and that the exchange has resumed withdrawals for major assets like Bitcoin and Ether. However, Chen expressed limited optimism regarding the full recovery of the stolen funds. The exchange has since rebuilt its Protection Fund to approximately $309 million.

Entities

Bitget · Chainalysis · Elliptic · Gracy Chen · Liquid Network · Mandiant · North Korea · SlowMist

Claims

What the coverage asserts, and how many sources carry each claim.

[● 2 SOURCES] Attackers were present within Bitget's systems for at least 24 days, with malicious activity traced back to August 31. airdropalert.com · www.tekedia.com
[● 12 SOURCES] The total estimated loss from the Bitget hack is approximately $387.5 million to $388 million. www.tekedia.com · www.voakorea.com · www.blockmedia.co.kr · coinedition.com · decrypt.co · +6 more
[● 2 SOURCES] Attackers gained access by compromising two third-party security products used by Bitget. airdropalert.com · www.tekedia.com
[● 8 SOURCES] The Bitget hack was carried out by North Korean-linked actors. www.voakorea.com · www.blockmedia.co.kr · decrypt.co · bitcoinworld.co.in · nationalcybersecurity.com · +2 more
[● 2 SOURCES] Bitget CEO Gracy Chen indicated that the recovery of stolen funds is expected to be limited. www.tekedia.com · insidebitcoins.com
[● 6 SOURCES] Chainalysis used AI tools to reduce the time required to reconcile bridge transactions from over 20 hours to under 10 minutes. www.blockmedia.co.kr · decrypt.co · bitcoinworld.co.in · nationalcybersecurity.com · blockonomi.com
[● 3 SOURCES] Customer account balances were not affected by the security incident. www.tekedia.com · coinedition.com · airdropalert.com
[○ 1 SOURCE] Bitget's Protection Fund has recovered to approximately $309 million. coinedition.com