Bitget turned eight years old on September 24 and marked the occasion with a $351.6 million hole in its balance sheet. The crypto exchange confirmed that hot and warm wallets were drained through what its own CEO called a forgery, not a break-in — and within a day, the trail of stolen funds was already being compared to North Korea's most notorious prior heist.

Forged withdrawal slips, not stolen keys

What makes this hack unusual is what didn't happen. Bitget CEO Gracy Chen was explicit that private key compromise has been ruled out — the attackers never obtained the cryptographic keys that actually control the exchange's wallets. Instead, they compromised the wallet backend system itself and spoofed transaction data, tricking the normal approval process into authorizing transfers that were never legitimate. Chen compared it to forged withdrawal slips passed through a bank's own teller window: the vault stayed locked, but the paperwork authorizing withdrawals was fake. Bitget says loss containment is now confirmed and no further unauthorized transfers are possible, though withdrawals remain suspended pending a full security review with no announced resumption date.

The North Korea evidence

Bitget hasn't issued a formal attribution, but the circumstantial case built by outside investigators is substantial. Blockchain analytics firm Elliptic found infrastructure overlap between wallets used to launder the Bitget funds and wallets previously tied to the 2025 Bybit hack — one of the largest crypto thefts ever attributed to North Korea. The stolen assets were also rapidly converted into native chain tokens immediately after the theft, a laundering pattern investigators have documented repeatedly in past DPRK-linked operations. Chen herself said the techniques used were consistent with groups linked to North Korea. None of that is a smoking gun, but it's the same combination of evidence — shared laundering rails, matching tradecraft, rapid conversion speed — that has correctly predicted attribution in nearly every major exchange hack of the last few years, including Ronin Bridge, Atomic Wallet, and Stake.com. Formal, on-the-record attribution from a government agency typically takes months or years longer than the circumstantial case investigators can build within days, which is part of why exchanges and analytics firms increasingly speak in terms of confidence levels and shared tradecraft rather than waiting for that slower, more definitive step.

The bigger number this fits into

Elliptic has tracked more than 51 separate DPRK-linked crypto incidents in 2026 alone, and with Bitget added to the tally, North Korea's attributed crypto theft for the year has now crossed $1 billion. That's on top of an already staggering April, when back-to-back breaches at Drift Protocol ($285 million) and KelpDAO ($292 million) — both also attributed to DPRK-linked actors — accounted for roughly $577 million in a single month. Add it up against the regime's documented history and the total attributed North Korean crypto theft since 2017 now exceeds $6 billion, funding a weapons program that international sanctions were specifically designed to choke off.

Why a nation-state, not a lone hacker, changes the calculus

The distinction matters for how exchanges and regulators respond. A opportunistic criminal hacker responds to better security practices — patch the bug, and the specific attack stops working. A state intelligence apparatus with a standing budget, a multi-year track record, and no expectation of ever facing arrest responds to better security by adapting its tradecraft, not by giving up. That's the uncomfortable read on North Korea's pattern: each major hack refines the laundering playbook for the next one, and the target list keeps moving from obvious weak points (bridges, hardware wallets) toward the internal approval systems of exchanges that assumed their perimeter, not their backend logic, was the thing worth hardening.

Why it matters

For anyone holding funds on a centralized exchange, the practical lesson isn't "use a different exchange" — Bitget is a large, established platform, and this wasn't a fly-by-night operation getting caught cutting corners. It's that exchange security has to extend past the vault to the systems that tell the vault what to do, and that a state-sponsored attacker with a $1-billion-a-year budget and no fear of prosecution is a fundamentally different threat model than the criminal hackers most security audits are built to catch. Expect this to accelerate a trend already underway: exchanges publicly disclosing proof-of-reserves and user protection funds not as a courtesy, but as the baseline cost of operating against an adversary this well-resourced.

Further reading

Frequently asked

Were user funds actually stolen, or just exchange funds?

Bitget says the $351.6 million came from the exchange's own hot and warm wallets, not individual user balances, and that its $464 million User Protection Fund covers the shortfall — meaning affected users should be made whole even though withdrawals remain paused during the security review.

How can an exchange lose money without a private key being stolen?

Bitget's CEO described the attack as forged withdrawal requests passing through the exchange's own approval process — the equivalent of a forged withdrawal slip at a bank teller window. The vault itself (the private keys) stayed secure; the fraud was in the instructions telling the system to move funds out.

How confident is anyone that North Korea did this?

Not proven beyond doubt, but the circumstantial case is strong: investigators found shared laundering infrastructure linking the stolen funds to the 2025 Bybit hack, a rapid conversion-to-native-token pattern matching prior DPRK operations, and Bitget's own CEO said the technique was consistent with DPRK-linked hacking groups.