North Korea-linked hackers breach major exchange

TLDR

North Korea-linked hackers are believed to be behind a roughly $387 million breach of centralized exchange Bitget on 24 September 2026.

1. Chainalysis and other investigators have attributed the Bitget hot wallet exploit to DPRK-linked actors, pushing 2026 North Korea crypto thefts above $1 billion.
2. Bitget says cold wallets and user balances remain intact, withdrawals are resuming in phases, and it will cover losses from its protection fund and capital rather than haircut users.
3. Stolen funds are being laundered across chains and privacy tools, and regulators are likely to tighten scrutiny of exchange security, cross-chain protocols, and privacy coins.

Deep Dive

1. What Happened And Who Was Hit

On 24 September 2026, centralized exchange Bitget suffered a hot and warm wallet breach, with about $387.5 million leaving the platform in 23 transfers during the first three hours of the attack. Investigators traced funds across Ethereum, the XRP Ledger, Zcash, Tron and several layer 2 networks, with roughly half initially routed to Ethereum and about 41 percent in XRP.

Blockchain analytics firm Chainalysis attributed the incident to DPRK-attributed threat actors, noting that this single hack pushed its tally of North Korea-linked crypto thefts in 2026 above $1 billion. Independent reporting from The Defiant and TokenPost cites the same attribution and figures, although Chainalysis has not publicly disclosed all underlying intelligence for the attribution.

Mandiant and SlowMist analysis, summarized in a Bitget-focused report, indicates the attackers compromised two third-party security products to gain privileged access to Bitgets production wallet systems and bypass withdrawal controls without stealing private keys.

2. User Impact And Exchange Response

Bitget has emphasized that its cold wallets were not affected and that internal ledgers still match user account balances. The exchange revised its loss estimate from about $352 million to around $387.5 million after reconciling assets on Zcash and Tron, and says it froze roughly $1.1 million tied to the attacker.

Its protection fund reportedly held more than $464 million before the incident, fell below $200 million after the theft, and has been rebuilt above $300 million using Bitgets own capital. Management has stated that Bitget will absorb the financial hit instead of imposing losses on customers, while gradually restoring withdrawals, starting with Bitcoin, Ethereum and major stablecoins.

3. Laundering Pattern And What To Watch

Investigators have traced tens of millions of dollars in stolen XRP through a cross-chain liquidity protocol into Bitcoin, with Bitquery identifying THORChain as a key route. Separate analysis shows about 2,746 ZEC linked to the hack being moved into Zcashs shielded pool, which significantly complicates forensic tracing.

Other infrastructure has actively pushed back. Near Intents blocked more than $50 million of an attempted laundering flow linked to the same attacker and froze roughly $500,000, while Tether and Circle blacklisted a wallet that held about $318,000 in USDT and USDC. Earlier in 2026, Mandiant tied a separate $295 million exploit of Solana-based protocol Drift, now Velocity, to North Korean group UNC6862, underscoring a broader DPRK focus on large crypto venues.

Conclusion

A sophisticated hot wallet breach at Bitget, now widely attributed to North Korea-linked actors, is one of the largest centralized exchange hacks to date and part of a broader DPRK cyber-finance strategy. While Bitget is currently shielding users through its protection fund and capital, the incident highlights how centralized infrastructure, cross-chain protocols and privacy tools can be exploited together. For crypto users and builders, the practical takeaway is to treat venue and counterparty risk as seriously as price risk and to watch closely how regulators, analytics firms and protocols respond to this latest high profile attack.