North Korean hackers very likely drained $350 million from Bitget, CEO says

Bitget CEO Gracy Chen said North Korea was very likely behind the $350 million hack. Chen said the attackers breached a critical backend system within Bitget's wallet infrastructure. The attackers did not obtain private keys for Bitget's hot, warm, or cold wallets. The attackers also did not fake user withdrawal requests. Chen said the attackers used the backend system to spoof transaction data and trigger Bitget's authorization process to move funds. Withdrawals remain suspended after the September 24 breach. Chen linked some IP addresses to VPN choices used by a certain Democratic People's Republic of Korea group. Chen did not name the group. On-chain analyst Specter said the stolen XRP was bridged and linked directly to AFX Trade exploit funds. AFX lost about $24 million in July. The attack had been attributed to TraderTraitor, a Lazarus-linked unit. LayerZero tied the KelpDAO bridge exploit to the same unit in April. Chen said the losses are contained. Chen said no further unauthorized transfers can occur. Lookonchain found that the attackers took 9 different assets. XRP represented the largest share at about 102.9 million tokens worth roughly $157.5 million. Bitget's confirmed loss is about double the roughly $176 million cited in initial on-chain reports. Bitget said its User Protection Fund has more than $464 million and covers the full loss. DefiLlama ranks the incident as the largest crypto hack of 2026 so far. Liquid Network recorded a $320 million incident in September. Drift recorded a $295 million breach in April. The tracker records about $2.2 billion in losses across 281 incidents this year. Bitget accounts for roughly 16% of that total. The incident makes September the costliest month of 2026 so far. April recorded roughly $648 million in losses. TRM Labs found that North Korean groups accounted for 76% of crypto hack losses through April. TRM Labs said those losses mostly came through the Drift and Kelp attacks. Lazarus carried out the $1.5 billion Bybit hack in 2025. Chen promised a full technical report after investigators confirm how the intrusion happened. The report should show whether forensic evidence supports the North Korea attribution.