Crypto assets stolen from Bitget on 24 September revised from $351.6 million to $387.5 million; Elliptic links the attack to North Korea with high probability

According to a 25 September report by The Hacker News, Bitget announced that suspected North Korean hackers had stolen $351.6 million from its hot and warm wallets at 18:31 UTC on 24 September; affected assets include ETH, XRP, BNB, AVAX, USDT and USDC, and Google-owned Mandiant and SlowMist were engaged for the investigation. According to the CEO, the attacker compromised a critical back-end system in the wallet infrastructure, spoofed transaction data and triggered the approval process; private keys were not stolen. According to Gizmodo, the loss was later updated to around $387.5 million, and Elliptic found the attack very likely to be linked to North Korea; the difference between the two figures stems from the update. According to Hackread, technical evidence supporting the attribution has not yet been published.

According to a 25 September CoinDesk report, Circle and Tether froze an address holding 170.47 ETH, 218,023 USDT and 99,990 USDC, worth around $318,000 in total; other attacker addresses still control more than 63,000 ETH. According to Gizmodo, Bitget said it would cover the loss with its user protection fund of 5,500 bitcoin worth more than $464 million, that withdrawals were suspended during the security review, and that deposits and trading continued. The company offered a 5% bounty to anyone helping with freezes and 5% to those contributing to recovery. According to Elliptic, this is the largest single crypto theft attributed to North Korea in 2026.