Bitget's $387.5 Million Breach Pushes North Korea Crypto Theft Tally Above $1 Billion

A billion dollar tally and a compromised approval system

The September 24, 2026 theft of $387.5 million from Bitget has pushed cryptocurrency losses attributed to North Korean hackers above $1 billion for the year, according to Chainalysis. Combined with $643 million attributed to those actors during the first six months, the breach brings the tally to at least $1.0305 billion.

The attack targeted something more complicated than a stolen password or exposed wallet key. Preliminary investigations describe an intruder gaining access through outside security products, taking control of a wallet processing server and forging approval information. Bitget's own infrastructure then authorized transfers that appeared legitimate.

Chainalysis said its October 1 investigation followed stolen XRP into Bitcoin and found laundering patterns associated with North Korean actors. Its investigators used artificial intelligence to automate one tracing task in under 10 minutes, compared with more than 20 hours of manual work. That speed did not mean the entire theft was solved or the money recovered.

The incident also exposed a financial network beyond the attackers themselves. Research into subsequent transactions identified fees earned by swap services, differing responses to suspicious funds and possible links to specialist laundering intermediaries. These details help explain why identifying stolen cryptocurrency on a public blockchain is only the beginning of recovering it.

Several findings remain preliminary. Chainalysis attributed the breach to North Korean actors, while Elliptic assessed that connection as highly likely. Public reporting has not established a conclusive attribution to Lazarus Group specifically, and the security vendors whose products allegedly provided access have not been named.

How the loss grew by $35.9 million

Bitget initially estimated the theft at $351.6 million. On September 25, it increased that figure to $387.5 million after identifying additional affected assets, including transfers involving Zcash and Tron. The $35.9 million increase reflected additional accounting, not a second attack, according to the exchange.

The totals vary slightly across investigations. Bitquery traced $386.80 million through 23 transfers across nine chains. A technical account put Bitget's broader count at about $388 million across 11 chains. Chainalysis described the initial distribution through four main networks: Ethereum received 49.7%, XRP 40.8%, Zcash 7.6% and Tron 1.8%. Those rounded percentages total 99.9%.

The figures describe different tracking scopes and should not be treated as identical inventories. The technical account put the XRP component at $157.8 million and estimated that about $214 million came from wallets Bitquery classified as warm. Hot and warm wallets are operational cryptocurrency pools used to support transactions and withdrawals, rather than reserves kept fully offline.

Reports also differ on when Bitget detected the problem. Several place detection at 18:31 UTC on September 24. A detailed reconstruction identifies that time as the first small transfers and places the reconciliation alert at 19:05. That distinction matters because the later account estimates that about $238 million, roughly 61% of the loss, left after the alert.

A timeline from intrusion to reopening

Preliminary findings attributed to Mandiant and SlowMist place the earliest logged malicious activity on August 31, more than three weeks before the theft. The public timeline separates initial access, the movement of funds and the exchange's response.

• August 31: The earliest recorded malicious activity allegedly exploited an unknown vulnerability in a security product.
• September 24, 17:49 UTC: A custom withdrawal tool began running on the wallet host.
• September 24, 18:31 UTC: The first traced transfers moved 93 TRX and then 0.84 ETH.
• September 24, 19:05 UTC: The detailed reconstruction places Bitget's reconciliation alert and restrictions on customer withdrawal requests at this time.
• September 24, 21:23 UTC: The last traced transfer moved 223.20 ETH. Wallet withdrawal services, including signing, were shut down at 21:44.
• September 25: Bitget identified the suspected root cause, reported the incident to law enforcement and revised its loss estimate.
• September 28 to 30: Bitcoin, Ethereum and USDT withdrawals reopened in stages. Preliminary forensic reports were published on September 30.
• October 1: Chainalysis published its attribution and tracing findings. Remaining services had been scheduled to return by October 2.

The detailed account says the signing service remained active for two hours and 39 minutes after the 19:05 alert. Blocking ordinary customer requests therefore did not immediately stop the attacker's separate route into the withdrawal process.

The attacker used the signer without stealing the keys

Bitget said the breach did not compromise its cold wallet keys or depend on fabricated customer withdrawal requests. Instead, the attacker allegedly supplied false transaction authorization data from inside the wallet infrastructure. A private key is the secret credential that authorizes a cryptocurrency transfer. Here, the concern was that a legitimate signing service could be instructed to approve an illegitimate transaction.

The preliminary technical reconstruction describes two unnamed security products. Activity on the first allegedly allowed a hidden script to read a database password stored in an environment variable. The attacker later operated the second product's management platform using an internal employee's identity, before reaching a production wallet server and installing malicious software.

SlowMist reportedly recovered a deleted tool tailored to Bitget's withdrawal system. It forged risk control fields and invoked the withdrawal process. The exact connection between the initial database access and the identity used in the second product remains unconfirmed.

Bitget described the entry point as a zero day vulnerability, a previously unknown software flaw. As of the October 2 technical account, neither vendor had been named and no public vulnerability identifier or advisory was available. Bitget said it fixed the weakness, but the public record did not provide enough detail for other customers to identify the affected products.

The exchange's separate Bitget Wallet product was unaffected. That service uses different infrastructure and lets users control their own assets. The distinction limits the known scope of the breach, without reducing the loss from the exchange's operational wallets.

What supports the North Korea attribution

Bitget chief executive Gracy Chen pointed to internet address behavior and blockchain transaction signatures when explaining the suspected North Korean connection. She described the technique in these terms:

consistent with techniques used by DPRK-linked hacker groups

Chen later described the connection as based on preliminary indicators. Chainalysis independently attributed the theft to North Korean actors, while Elliptic cited links to laundering addresses associated with earlier thefts, including Bybit. TRM Labs also assessed a North Korean connection as likely in the technical account.

These assessments are not interchangeable with a public criminal finding. Mandiant's preliminary work did not name an attacker, and the investigations have not publicly established that a particular Lazarus subgroup carried out the Bitget intrusion.

The annual figures also require care. Drift Protocol's $285 million April 1 loss and KelpDAO's $292 million April 18 loss together account for $577 million, about 90% of the $643 million attributed to North Korean actors in the first half. Researchers linked the KelpDAO exploit to TraderTraitor, a group associated with attacks on infrastructure connecting blockchains. Elliptic separately counted more than 51 suspected North Korean incidents in 2026, a broader category than confirmed losses.

AI accelerated a specific part of the money trail

Chainalysis said it worked with Bitget and law enforcement to follow the stolen assets. Within about three hours, funds had moved through 23 transfers, before passing through liquidity protocols, messaging services, instant swaps and laundering services.

A central task involved matching stolen XRP deposited into a protocol with Bitcoin paid out elsewhere. Such services let users exchange assets across different blockchains. Investigators must connect the incoming and outgoing transactions even when they use different assets, addresses and transaction records.

Chainalysis followed tens of millions of dollars through that route over roughly a day and a half, reaching Bitcoin addresses controlled by the attacker. It said automation built with its internal AI reduced the reconciliation task from more than 20 hours to under 10 minutes, with human investigators directing the work and reviewing results. On those estimates, the task took less than one hundred and twentieth of the previous time.

Other movements were harder to follow. The attacker began putting funds into Zcash's shielded pool, where privacy features conceal transaction details that would otherwise help link senders, recipients and amounts. Chainalysis said it would continue monitoring destination addresses and sharing information with exchanges and law enforcement.

Tracing does not itself permit seizure. Bitcoin and ether have no central issuer able to freeze a balance. Recovery generally requires a cooperating platform, an issuer with freezing powers or authorities obtaining control of the assets.

Swap services split over whether to intervene

NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers associated with the breach and froze about $503,000 during execution. General manager Alex Shevchenko said roughly $166,000 passed through before the suspected flows were stopped.

THORChain continued processing swaps and rejected Bitget's request for selective intervention. The protocol distinguished its emergency network halt, intended to protect its own operations, from blocking individual addresses or transactions. It pointed to its own $10.7 million May exploit, saying those attackers had not subsequently been blacklisted from swaps either.

A September 29 BlockSec snapshot estimated about $269 million in Bitget related flows across 7,804 THORChain transactions. That is throughput, not necessarily distinct stolen value: the same funds may be counted more than once as they move through the service.

Freeze estimates also differ. One account put Circle and Tether's combined stablecoin freezes at roughly $318,000. A broader October 1 technical estimate placed freezes involving those issuers and NEAR Intents at about $1.1 million. These figures have different dates and coverage and should not be added together as separate recoveries.

Laundering transactions generated fees and a trading surge

Independent researcher Andrey Sergeenkov calculated $761,725 in service and protocol fees from reviewed transactions through October 2 at 10:22 UTC. His breakdown assigned $573,226 to THORChain liquidity providers, $149,417 to MetaMask, $26,751 to Chainflip and $12,332 to CoW EthFlow.

He separately identified $259,718 in THORChain affiliate fees paid to seven addresses with additional financial connections to wallets involved in the swaps. Another $206,196 went to recipients for which he had not established those additional connections. These affiliate categories are separate analytical figures, not amounts recovered.

Being named as a fee recipient does not prove attacker ownership. Sergeenkov traced some proceeds from the largest connected recipient, which received $177,499, into USDT and eventually an address labeled OKX Hot Wallet 5. That trail does not establish the identity of the exchange customer or participation in the theft.

THORChain recorded $3.01 million in September system income and $2.40 billion in swap volume. Between September 25 and 29, it processed about $1.37 billion, 57% of monthly volume, and generated roughly $1.9 million, 63% of monthly income. These period totals include activity beyond identified stolen funds.

The protocol's statement described the timing of the surge:

Between September 25 and 29, daily volume ran between roughly $190M and $460M as funds linked to the Bitget exploit moved through the network.

Active wallets increased from 23,500 in August to 25,000 in September, about 6.4%. That modest growth contrasted with swap volume rising from $613 million to $2.40 billion. The figures point to concentrated large transactions rather than a comparable expansion in users.

Intermediaries may get attackers paid before funds disappear

Investigations into the February 21, 2025 Bybit theft illustrate why visible stolen funds may no longer represent money still controlled by the original hackers. The FBI attributed that approximately $1.5 billion attack to North Korea's TraderTraitor actors. Researchers suspect specialist intermediaries accepted stolen assets, paid attackers their value minus fees and assumed the risk of subsequent laundering.

Security firm zeroShadow estimated that more than $1 billion from Bybit was laundered between February and June 2025. That does not establish that the entire amount became conventional currency or equaled the attackers' net proceeds. Chainalysis also described tens of millions from Bybit and WazirX passing through Xinbi's vendor network, where intermediaries allegedly exchanged traceable assets for stablecoins from other criminal activity.

In an October 5 disclosure, pseudonymous investigator ZachXBT said he put up $349,700 in stablecoins and accepted a 5% loss on each order while posing as a customer. He said an operator called Jimmy Green helped expose a cluster holding more than $12 million in Bybit related funds, with Tether subsequently freezing 442,000 USDT.

ZachXBT alleged the network operated across Hong Kong and mainland China and laundered more than $1 billion for Lazarus. Its size and the operator's identity have not been independently confirmed through public charges. He also alleged that Chinese actors handling Bitget funds sought assistance in public Discord and Telegram groups, and that one operator had handled KelpDAO proceeds.

Bitget's financial backstop and the limits of recovery

Bitget said its User Protection Fund exceeded $464 million before the attack and would cover customer losses. The $387.5 million theft equals about 83.5% of a $464 million reserve. That comparison measures the potential burden, not proof of how compensation was paid or which assets funded it.

On September 28, the exchange pledged to restore the fund to at least $300 million within a week. It announced completion on September 30. It also offered rewards of up to 5% for successfully frozen or recovered funds, partnered with Mandiant and SlowMist and released a wallet tracking dashboard.

Trading and deposits remained open during the withdrawal pause, according to Bitget. Bitcoin withdrawals resumed September 28, Ethereum followed September 29 and USDT September 30. The exchange said there were no further losses during the suspension. Its BGB token fell almost 7% to $1.93 before recovering to $1.97 in the reported trading snapshot.

The broader September toll was also disputed in scope. PeckShield counted 55 hacks totaling $766.5 million, while CertiK counted 97 incidents totaling $768.4 million. Bitget represented about half of either total. Reports placed a separate Liquid Network loss at $319 million to $320 million, with more than $270 million reportedly returned. Another reported Coldcard incident involved about $116 million in July.

Enforcement efforts extend beyond exchange thefts. The U.S. Treasury sanctioned eight individuals and two entities accused of laundering cybercrime and overseas IT worker revenues. Its allegations included bankers managing at least $5.3 million through First Credit Bank and concealment through intermediaries in China and Russia. Separate Justice Department actions involved $7.7 million tied to alleged IT worker fraud and more than $15 million linked to four thefts attributed to APT38.

These actions show why freezing, seizure and restitution are distinct stages. Bitget's remaining recovery amount, the identity of the vulnerable vendors and a final technical account are still unresolved. No firm date for a final investigation or return of the stolen assets has been announced.

Key Points

• Bitget's revised $387.5 million loss brings the stated North Korea related 2026 theft tally to at least $1.0305 billion.
• Preliminary findings describe forged approval data, not stolen private keys, as the mechanism enabling withdrawals.
• Chainalysis attributed the attack to North Korean actors; a specific Lazarus attribution remains unconfirmed publicly.
• AI reduced one fund tracing task to under 10 minutes, but tracing did not recover the assets.
• Swap services differed over intervention, while reviewed laundering transactions generated substantial fees.
• Bitget announced a restored protection fund of at least $300 million and reopened withdrawals in stages.
• The final recovery total and the identities of the affected security vendors remain unknown.