30th September 2026
By Shubhii Verma
North Korean hackers are suspected of stealing $387.5 million (€332.8 million) in cryptocurrency from exchange Bitget, making it the largest crypto theft reported so far this year, according to blockchain intelligence firm TRM Labs.
How the $387.5M Bitget Crypto Heist Happened
Bitget said it detected unauthorized transfers from hot and warm wallets on Thursday. Hot wallets remain connected to the internet for transactions, while warm wallets have limited access. The exchange said its cold wallets, which are kept offline or more isolated, were unaffected.
Bitget CEO Gracy Chen said IP addresses identified during the investigation showed VPN usage matching a North Korean hacking group, making a connection to the country “very likely.” Chen also said the attackers did not obtain private keys controlling the exchange’s wallets.
Instead, the hackers reportedly breached an internal system and inserted false transaction information, causing fraudulent transfers to appear legitimate to Bitget’s approval process.
Bitget Says User Funds Remained Protected
The exchange said its user protection fund, which held more than $464 million (€398.5 million) when the incident occurred, was sufficient to cover the stolen assets. Customer balances remained accurate, while deposits and trading continued operating.
Bitget temporarily suspended withdrawals as a precaution while investigating its systems. The company said withdrawals would be restored in stages from September 28. It notified law enforcement and is working with cybersecurity firms to investigate the attack and trace the stolen funds.
Chen said members of Lazarus, a North Korean state-linked hacking group known for cryptocurrency thefts, had previously contacted her while posing as a journalist seeking to arrange a Zoom interview.
North Korea has repeatedly been linked to cryptocurrency thefts. TRM Labs reported that North Korean groups accounted for 76% of the value stolen in crypto hacks through April this year, before the Bitget incident.
North Korea’s History of Major Crypto Theft
In February 2025, North Korean hackers stole approximately $1.5 billion (€1.28 billion) in virtual assets from exchange Bybit, according to the US Federal Bureau of Investigation. The FBI said the attackers converted some of the assets into other cryptocurrencies and distributed them across thousands of addresses to make tracking more difficult.
The US Treasury Department has said funds stolen by North Korean state-linked hackers help support the country’s nuclear weapons and ballistic missile programmes.
