Security

Bitget's $388M Breach: Inside the North Korean Heist That Drained a Top Exchange

2026-10-04

Bitget, one of the world's largest crypto derivatives exchanges, got properly mugged on September 24, 2026. Hackers made off with approximately $388 million—making this the second-worst exchange breach in crypto history, behind only the 2025 Bybit disaster. The exchange has now frozen $1.1 million in stolen assets and limped through recovery operations, but most of the money is already gone.

What's particularly instructive here is how the attack actually happened. The perpetrators didn't crack private keys or tunnel through Bitget's core security. Instead, they weaponised the exact sort of operational sloppiness that kills most security-conscious firms. They exploited vulnerabilities in third-party software Bitget had acquired, stole internal login credentials, and issued fraudulent withdrawal requests that drained hot and warm wallets across 12 different addresses. The cold storage stayed safe, which is almost certainly the only reason this didn't become a complete extinction event.

The forensics tell the story of a well-drilled operation. Chainalysis attributed the hack to North Korea-linked actors—the same crowd behind an estimated $1 billion-plus in crypto theft across 2026. Within the first three hours, stolen funds began hopping across blockchains: Ethereum, XRP, Zcash, Tron. Privacy mixing services like Wasabi got a workout. Attackers cycled assets through cross-chain bridges and multiple exchanges, the classic layering dance designed to obscure provenance and make recovery impossible.

ZachXBT, the pseudonymous on-chain investigator, picked up the trail through Telegram, identifying suspicious BNB Chain hot wallet withdrawals and tracking how the stolen assets moved through KuCoin before conversion to bitcoin. He's promised deeper data on the laundering network in coming weeks, but the pattern is already clear: maximum velocity, maximum opacity.

Bitget's response has been methodical, if grim. CEO Gracy Chen told CNBC the exchange is "not expecting to recover a lot of funds"—a sober assessment given how rarely stolen crypto resurfaces. The exchange did pull a move that deserves credit, though: instead of asking customers to eat the loss, they deployed their Protection Fund to cover the gap. That fund has already been rebuilt to $309 million, funded by the exchange itself. Withdrawals resumed in phases starting September 28, with full service restored across most assets by early October.

The bigger picture is less reassuring. September 2026 was the worst month for crypto security losses in the entire year—$768 million across 55 separate incidents, up 462% from August. Bitget and the Liquid Network exploit (which at least recovered most of its $320 million) accounted for more than 80% of those losses. Year-to-date, 2026 has already accumulated $2.68 billion in security losses across 656 incidents.

For investors, the usual harsh lesson applies: exchanges remain targets, even well-capitalised ones with solid reputations. Cold storage works. Everything online is exploitable. And the moment your crypto sits on someone else's servers, you've ceded control to their security posture—which is, statistically speaking, going to fail at some point.

Source & further reading:

Sources