Bitget Chief Executive Officer Gracy Chen stated that North Korea is “very likely” responsible for the $350 million hack affecting the platform. She noted that the culprits compromised a backend system without ever accessing private keys.
Following the September 24 security breach, withdrawals remain halted. Figures from DefiLlama currently categorize this event as the largest cryptocurrency theft of 2026.
Chen Follows a VPN Trail to North Korea
During a live Q&A session on X following the attack, Chen pointed the finger at the Democratic People’s Republic of Korea (DPRK).
“But we’ve identified some IP addresses that match the VPN choices by a certain DPRK group. So we think this is very likely to be attacked by North Korean,” she said.
While Chen did not specify a particular faction, blockchain analyst Specter pointed out that the stolen XRP has been bridged and connects directly to funds taken in the AFX Trade exploit.
The AFX incident resulted in a loss of roughly $24 million in July and was previously linked to TraderTraitor, a unit associated with Lazarus. Furthermore, LayerZero connected the KelpDAO bridge breach to that same unit back in April.
How the Bitget Hack Bypassed Private Keys
According to Chen, the perpetrators did not acquire private keys for Bitget’s cold, warm, or hot wallets, nor did they forge user withdrawal requests. She elaborated on the attack vector in a subsequent post.
“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out,” she explained.
She emphasized that damages are contained and additional unauthorized movements are impossible. Data from Lookonchain reveals that the bad actors absconded with nine distinct assets.
XRP accounted for the largest portion, with approximately 102.9 million tokens valued near $157.5 million. Bitget’s verified losses are roughly double the initial on-chain estimates of $176 million.
The cryptocurrency exchange asserts that its User Protection Fund, which currently exceeds $464 million, is sufficient to cover the entire deficit.
The Biggest Crypto Heist of 2026 Lands at Bitget
DefiLlama metrics place the Bitget security breach as the foremost crypto hack of 2026 so far, surpassing the September incident involving Liquid Network worth $320 million and the Drift breach in April valued at $295 million.
The tracking platform reports roughly $2.2 billion lost across 281 separate incidents this year, with Bitget responsible for about 16% of that aggregate sum. This event also positions September as the most expensive month of 2026 to date, eclipsing April’s total of roughly $648 million.
Early-year losses in 2026 have been heavily driven by North Korean hackers. Research by TRM Labs indicated they were behind 76% of all crypto hack losses up to April, driven largely by the Kelp and Drift exploits. Previously, in 2025, the Lazarus Group executed the $1.5 billion Bybit hack, which stood as the largest heist of that year.
Chen has committed to releasing a comprehensive technical report once investigators finalize their analysis of how the breach occurred. That documentation is expected to clarify whether forensic proof supports the North Korean attribution.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights