{"id":3156,"date":"2026-09-25T11:25:12","date_gmt":"2026-09-25T11:25:12","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3156"},"modified":"2026-09-25T11:25:12","modified_gmt":"2026-09-25T11:25:12","slug":"bitget-says-suspected-north-korean-hackers-stole-351-6m-after-backend-compromise","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3156","title":{"rendered":"Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 25, 2026<\/span><\/span>Cryptocurrency \/\u00a0Cybercrime <\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. <\/p>\n

\u00abAt 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limited number of hot wallets,\u00bb BitGet said<\/a> in a post shared on X. \u00abBitget’s cold wallets and the overwhelming majority of platform assets remain secure and unaffected.\u00bb<\/p>\n

The company emphasized that customer account balances remain accurate, and deposits and trading continue to operate normally. However, withdrawals have been temporarily suspended out of an abundance of caution while a \u00abcomprehensive security review\u00bb is underway.<\/p>\n

Bitget did not disclose any details on how the attack took place, but said it has enlisted the help of Google-owned Mandiant and SlowMist for a third-party investigation.<\/p>\n

\u00abBitget Wallet operates as a self-custodial wallet on a completely separate and independent infrastructure from Bitget Exchange and was not affected by this incident,\u00bb it noted<\/a>.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

According<\/a> to Bitget CEO Gracy Chen<\/a>, assets impacted by the hack include ETH, XRP, BNB, AVAX, USDT, and USDC, with the chains involving Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base.<\/p>\n

\u00abWe have contacted the foundations of all affected chains, and some foundations have confirmed the freezing of hacker wallet addresses,\u00bb Chen said. \u00abBased on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations.\u00bb<\/p>\n

\u00abThe attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation.\u00bb<\/p>\n

The development comes about a week after SentinelOne attributed the North Korea-linked TraderTraitor group to an attack targeting an India-based information technology (IT) services company. TraderTraitor is best known for the theft of $1.5 billion from Bybit and $292 million from KelpDAO’s LayerZero bridge.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Sep 25, 2026Cryptocurrency \/\u00a0Cybercrime Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. \u00abAt 18:31 UTC on September 24,…<\/p>\n","protected":false},"author":1,"featured_media":3157,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3543,3544,3542,869,338,337,247,36,2368],"class_list":["post-3156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-351-6m","tag-backend","tag-bitget","tag-compromise","tag-hackers","tag-korean","tag-north","tag-stole","tag-suspected"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3156"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3156\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3157"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}