Bitget Reports $352 Million Hack, Points to North Korean Hackers, Suspends Withdrawals
Bitget disclosed roughly $352 million in unauthorized transfers from its hot and warm wallets, suspending withdrawals while pointing to North Korean hacker patterns. The loss, the largest crypto heist of 2026, approaches three-quarters of the exchange's $464 million User Protection Fund.
What happened
Cryptocurrency exchange Bitget disclosed on Thursday, September 25, 2026, that approximately $351.6 million in unauthorized transfers had been drained from its wallets, according to TechCrunch. The company's chief executive, Gracy Chen, announced the breach in posts on X and said the intrusion was "highly consistent with known patterns of North Korean hacker organizations."
Chen moved to reassure the exchange's user base, stating: "User funds are safe... The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over US$464 million." She added that "Deposits and trading remain fully operational" while "Withdrawals are temporarily paused and will be restored as soon as the security review is complete," as reported by The Business Times. No timeline was given for the restoration of withdrawals, though the company said a full incident report with a root cause analysis is due within 24 hours.
The breach was confined to portions of Bitget's hot-wallet and warm-wallet layers, with cold wallets remaining secure. Bitget operates a three-tier wallet architecture consisting of hot wallets that are online, warm wallets that serve as an intermediate layer, and cold wallets that are kept offline. The exchange, founded in 2018 and registered in the Seychelles, counts 120 million registered users and grew rapidly in the aftermath of the 2022 FTX collapse.
Blockchain intelligence firm TRM Labs estimates that North Korea is behind around three-quarters of all crypto thefts during 2026 to date, and such collectives are suspected of funding the country's nuclear weapons program. Blockchain-analytics platform Lookonchain reported that the hacker has already swapped about $183 million of the stolen funds for Ether tokens. Arkham Intelligence analyst Emmett Gallic identified unauthorized movements involving ETH, BNB, AVAX, and USDT0 across multiple blockchains.
Why it matters
This is the largest known crypto heist of 2026, eclipsing a $340 million September hack in which the attacker returned all but $47 million of the stolen assets. Earlier in September, $320 million in Bitcoin was drained from a wallet used by blockchain Liquid Network, and in August the Coldcard offline Bitcoin wallet was hacked. The string of incidents has put exchange security back at the center of the industry's agenda.
The scale of the loss relative to Bitget's own safety net is what gives the event its weight. Esme Pau, head of capital markets and policy at blockchain-security company CertiK, called it "one of the most substantive centralised exchange exploits of 2026" and "another wake-up call for the digital-assets industry." Pau noted that a drain equal to roughly three-quarters of the exchange's User Protection Fund "makes it a crisis event," a pointed observation given that the fund holds over $464 million against a loss of about $351.6 million.
Aneirin Flynn, chief executive of cybersecurity firm FailSafe, said the hack "destroys the illusion that major exchanges have solved hot-wallet security" and "severely damages institutional trust in crypto infrastructure." The market's immediate verdict was measured but negative: Bitget's native BGB token fell 2.9% on the news. The suspension of withdrawals at an exchange of this size, even a temporary one, is itself a stress test of user confidence, since the ability to exit positions is the core promise of any trading venue.
The suspected North Korean connection also matters beyond the exchange itself. If TRM Labs' estimate that such groups account for roughly 75% of 2026 crypto thefts holds, then proceeds from incidents like this one are believed to feed directly into a sanctioned state's weapons program, which keeps digital-asset security firmly within the orbit of national security policy rather than purely commercial risk management.
How it is being covered
The story is being carried widely, with 97 sources covering it, 20 of them rated, according to ground.news. The political breakdown of that coverage is 15% left, 60% centre and 25% right, and 9 of the 20 rated outlets score high on factuality with a further 5 rated very high. Ground.news flags no blindspot in the coverage, meaning no significant perspective is missing from the reporting across the spectrum.
What to watch
The first marker is the full incident report with root cause analysis that Bitget has committed to delivering within 24 hours of the disclosure, which should clarify how the hot and warm wallet layers were compromised. The second is the restoration of withdrawals, for which no timeline has been given, and any further movement of the stolen funds on-chain, where Lookonchain and Arkham Intelligence are tracking conversions into Ether and other tokens. A third item is whether the User Protection Fund's capacity comes under visible strain, given that the loss approaches three-quarters of its stated holdings, and whether regulators in the jurisdictions where Bitget operates respond to the breach.
By the numbers
Source snapshot
