---
title: North Korea Suspected in $351 Million Bitget Crypto Heist
description: Hot wallet breach hit ETH, XRP, and BNB, with withdrawals paused. Bitget says its $464 million protection fund covers the loss.
canonical_url: https://codekeeper.co/ticker/bitget-crypto-hack-north-korean-hackers
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# North Korea Suspected in $351 Million Bitget Crypto Heist

Hot wallet breach hit ETH, XRP, and BNB, with withdrawals paused. Bitget says its $464 million protection fund covers the loss.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 28, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cryptocurrency exchange Bitget lost roughly $351.6 million on September 24, the largest known crypto heist of 2026 so far. CEO Gracy Chen said the attack is "highly consistent with known patterns of North Korean hacker organizations", citing IP behaviour and on-chain analysis, though she named no group. TRM Labs attributes about three-quarters of this year's crypto thefts to North Korea. ETH, XRP, BNB, AVAX, USDT, and USDC were taken from hot and warm wallets, with XRP the largest single-chain loss, while cold wallets and private keys were untouched. Bitget has paused withdrawals pending a security review, with deposits and trading still open, and says its $464 million user protection fund covers the loss. Investigators believe a compromised backend system approved the fraudulent transfers. Mandiant and SlowMist are assisting. Source: [SecurityWeek](https://www.securityweek.com/north-korea-suspected-in-351-million-bitget-crypto-heist/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbitget-crypto-hack-north-korean-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cloud and SaaS Environments Are Now Attackers' Favorite Targets Aug 11, 2026](https://codekeeper.co/ticker/cybersecurity-threats-2026-cloud-saas-ai)

[Russian Hackers Are Still Exploiting a Year-Old WinRAR Flaw Against Ukraine Aug 12, 2026](https://codekeeper.co/ticker/russian-hackers-exploit-winrar-flaw)

[Cyberattacks Phishing Attack Bypasses Microsoft 365 MFA to Hijack a Finance Mailbox and Steal Payments Aug 24, 2026](https://codekeeper.co/ticker/phishing-attack-microsoft-365-bypass-mfa)

[Russian Hackers Exploited Zimbra Zero-Day to Target US and Ukrainian Organizations Aug 11, 2026](https://codekeeper.co/ticker/russian-hackers-exploit-zimbra-flaw)