Bitget Hack: How Suspected Lazarus Hackers Took $387.5M

At 18:31 UTC on 24 September 2026, Bitget's own authorization system started approving transfers to an attacker. By the time on-chain watchers noticed, the money was moving across at least seven chains. By the time the CEO posted, the number was $351.6 million; the next afternoon Bitget raised it to $387.5 million. According to Bitget, not one private key had been stolen.

That last detail is the whole story. The Bitget hack is bigger than either of the two North Korea-linked heists that dominated the first half of 2026 (KelpDAO at $292 million and Drift at $285 million, per TRM Labs), but its size is not what should worry you. What should worry you is that it used the same move that emptied Bybit, DMM Bitcoin and KelpDAO: leave the keys alone and lie to whatever tells the keys what to sign.

This is a working analyst's read of the incident, written at roughly the 18-hour mark and updated on 28 September. You get what Bitget has confirmed, the attack chain as a diagram, the timeline, where the money went on-chain, why everyone is saying "Lazarus" and how much weight that label can actually bear, and what exchanges should change.

Status: updated 28 September 2026, 08:15 UTC. First published 25 September, about 18 hours after the theft. More than three days in, Bitget has not published its root-cause report and no government has attributed the attack. Throughout, we separate what Bitget has confirmed, what analysts claim, and what is our own inference.

Update, 28 September 2026. At 14:05 UTC on 25 September Bitget revised the loss to about $387.5 million, up from its first estimate of $351.6 million. The extra $35.9 million is not new theft: Bitget says its first count left out transfers on Zcash and TRON made during the same incident. It also says the underlying vulnerability has been found and fixed, launched a 5% recovery bounty with a public fund tracker, and set a phased withdrawal restart: BTC from 08:00 UTC on 28 September, ETH on 29 September, USDT on 30 September, everything else on 2 October. BTC withdrawals did reopen: Bitget announced at 07:59 UTC on 28 September that withdrawals on the Bitcoin network were open, and its public API showed them switched on between our checks at 07:40 and 08:03 UTC. In a livestream that morning, according to TechFlow and PANews, CEO Gracy Chen said the attackers got in through a vulnerability in a third-party security product, stole intranet credentials and forged withdrawal commands, and that Bitget plans to refill its protection fund to at least its $300 million baseline within a week.

TRM Labs and Elliptic have both published on-chain links between the Bitget proceeds and wallets that laundered earlier North Korean thefts, including Bybit. And the laundering is under way: funds are going through THORChain into Bitcoin, all five XRP holding wallets were emptied by 27 September, and one 10,000 ETH wallet has been emptied while a second is being drained. Still missing: the root-cause report, the name of the third-party product, and any government attribution. The sections below are updated where these facts change them.

What Happened in the Bitget Hack

The Bitget hack is the theft of about $387.5 million from the hot and warm wallets of Bitget, one of the largest centralized crypto exchanges, detected on 24 September 2026. According to Bitget, the attacker compromised a backend system inside its wallet infrastructure, used it to spoof transaction data, and triggered the exchange's own authorization process to send funds out across nine blockchains. Bitget first put the loss at $351.6 million and raised it the next day, after counting Zcash and TRON transfers it had missed. Bitget says private keys were not compromised, its cold wallets were untouched, and the loss is covered by its User Protection Fund. It suspects North Korean hackers. No government has confirmed that yet.

Here is the incident on one screen.

CEO Gracy Chen posted the notice on X at 21:30, and a near-identical version went up on Bitget's support center, timestamped 21:39. Read it closely and you can see the shape of the problem before Bitget ever described the mechanism: cold storage fine, hot and warm tiers bleeding, and a promise not to "speculate on the attack vector."

Figure 1: Bitget's official notice of 24 September, trimmed to the confirmed facts and actions taken. Note the three-tier wallet language: the attacker reached the tiers that are allowed to sign quickly. The $351.6 million shown here was Bitget's first estimate; it revised the figure to $387.5 million on 25 September. Screenshot from the Bitget Support Center.

Three edits separate this page from the CEO's post. "The full amount of this loss" became "the loss relating to this platform-wide incident." "Law enforcement" became "relevant authorities." And the promises of hourly updates and a report within 24 hours are gone. None of that is a scandal. It is a reminder that in the first day of an incident, you should cite the exact document and timestamp you are quoting, because the documents themselves move.

The Bitget Hack Timeline, Hour by Hour

The best way to understand an incident is to lay three clocks side by side: when the attacker acted, when outsiders noticed, and when the victim spoke.

Figure 2: Three clocks on one axis: what moved on-chain, what public trackers saw, and what Bitget said. The shaded band is the theft window. Note how long the XRP Ledger leg ran, and how far early public estimates trailed Bitget's count. The axis ends at 08:00 UTC on 25 September, before Bitget raised its figure to $387.5 million at 14:05. Compiled from Bitget and CEO posts on X, bitget.com, WuBlockchain, CoinDesk, Decrypt and our own on-chain checks.

The theft window opened at 18:31 with a 0.84 ETH test transfer out of a Bitget hot wallet, per Unchained. The XRP started moving at 19:01. At about 19:34 a fresh address on Arbitrum received 19.67 million USDT0 and swapped it into 7,111 ETH through UniswapX and 1inch Fusion in about six minutes, overpaying by up to roughly 5%. Nobody overpays by 5% unless the alternative is losing the whole amount to a freeze.

The first public flag on X came at 19:57. Arkham analyst Emmett Gallic posted a $178 million estimate at 20:24 and raised it to $183 million at 20:35 (CoinDesk). The last visible EVM outflow landed at 20:55, on Avalanche, according to the WuBlockchain timeline recap. On the XRP Ledger, a Bitget wallet made its last payment to the attacker at 21:19, which we confirmed on-chain.

Bitget spoke at 21:30. Three hours after detection, the number jumped from the $180 million to $184 million that trackers could see to $351.6 million. The gap was mostly the XRP Ledger leg, which early trackers had not counted. It moved once more: at 14:05 UTC on 25 September Bitget raised the total to $387.5 million, adding transfers on Zcash and TRON from the same window that its first count had missed. On-chain, the attacker's Zcash address received its ZEC at 19:03 and 21:19, and its TRON address its TRX at 19:16, all inside the theft window.

At 00:43 on 25 September, Chen posted the technical update that turned this from "exchange hacked" into a case study. By 07:10 Bitget had named its outside responders: Mandiant and SlowMist.

One gap deserves an honest flag. Bitget says its emergency response team was active "within minutes of detection." On-chain, Bitget wallets were still paying the attacker on the XRP Ledger at 21:19, nearly three hours after detection and eleven minutes before the public notice, and containment was not confirmed until 00:43. There are innocent explanations (transactions already signed and queued before the response kicked in, for instance). There is also a less comfortable one. We do not know yet, and neither does anyone writing with certainty about it.

How the Attack Worked: Draining an Exchange Without Stealing a Key

Most people picture an exchange hack as key theft: someone gets the seed phrase, empties the wallet. The Bitget hack does not fit that picture, and the difference is the most useful thing in this article.

A large exchange runs its wallets in tiers. Cold storage is offline and slow to move by design. Warm wallets refill the hot tier under separate approval. Hot wallets pay out customer withdrawals in seconds, so their keys have to be online, usually inside an HSM or an MPC signing cluster. Between the customer clicking "withdraw" and a signature coming out of that cluster sits a pipeline: a service creates the withdrawal, risk engines check it, and an authorization layer tells the signer "this one is approved, sign it."

In Chen's words, the attacker "compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out." And: "Private key compromise has been ruled out."

Put those two sentences together. The HSM or MPC cluster did its job perfectly. It signed what it was given. What it was given was forged.

Figure 3: Bitget's withdrawal pipeline and where the attacker entered it. The red path is the attack as Bitget has described it; the blue path is normal customer traffic, which Bitget says was not forged. Step 0 is the CEO's account (a vulnerability in a third-party security product, per her 28 September livestream) and is not yet documented in any published report. Diagram: CTI Academy.

Walk the chain from the top.

Step 0, initial access, is only partly disclosed. In her first livestream, according to TechFlow, Chen said the preliminary assessment points to a supply chain attack: a third-party tool Bitget uses every day was breached, not its core systems, and that tool reached the wallet backend. She also said the final attack vector still needs confirmation, and Bitget has not named the tool or the vendor. On 25 September Bitget wrote that its security team had identified the attack path, "including details of how the attacker bypassed existing security controls," and that the underlying vulnerability had been fixed, but as of 28 September it had published neither. In a second livestream on 28 September, Chen said a full trace showed the attackers had exploited a vulnerability in a third-party security product to steal intranet access credentials, then forged withdrawal commands to the wallet system so that the transfers bypassed risk checks, as TechFlow and PANews reported. Neither report names the product, and she said the technical details will come in a formal security report. We draw it dashed for that reason. What the vulnerability was, and whether it meant a breach at the vendor or a flaw exploited in Bitget's own deployment of the product, is the open question. If this is TraderTraitor, the documented route into a vendor is a fake recruiter on LinkedIn or Telegram, a "coding challenge" that runs malware on an engineer's machine, and then stolen session tokens or cloud credentials (Unit 42; Wiz). That is a hypothesis to test, not a fact to repeat.

Step 1, a backend foothold, is confirmed. "A critical backend system within our wallet infrastructure." Bitget has not named the component. If the third-party account holds, this is the Bybit pattern again: the attacker never needed to break the exchange's own perimeter, only something the exchange already trusted.

Step 2, spoofed transaction data, is the heart of it. The attacker forged transfer data at the layer that feeds authorization. Chen added in her live Q&A that user withdrawal requests were not forged. So this was not a flood of fake customer withdrawals. It was the exchange's own internal plumbing, instructing its own signer to pay the attacker.

Step 3, authorization fires. Keys used as designed, never exfiltrated. If that assessment holds, it is genuinely good news for Bitget's cold storage, which should not need emergency rotation. It is bad news for everyone who thinks an HSM or MPC deployment is the end of the conversation. Hardware protects the key. It does nothing about the truth of the input.

Step 4, hot and warm wallets drained across nine chains, with the cold tier untouched. The tiering worked as a blast-radius limit. It did not work as a theft limit, because the hot and warm tiers held more than a third of a billion dollars.

Step 5, freezable assets dumped first. About $80 million of the roughly $88 million in USDT, USDC, USDT0 and XAUt was swapped into ETH within about 90 minutes of the first transfer. More on that below, because it tells you who you are dealing with.

Figure 4: The post that disclosed the mechanism, 00:43 UTC on 25 September. The key phrase is "spoof transaction data," and the key omission is how the attacker reached that backend. Source: @GracyBitget on X.

Where the Money Went: Following $387.5M On-Chain

The first day of laundering split cleanly into two very different behaviors, and the split was deliberate.

Figure 5: Two exits, plus the two legs Bitget added to its count later. On EVM chains the attacker raced to shed anything an issuer could freeze; on the XRP Ledger, where native XRP cannot be frozen, they slowed down. EVM and XRP balances are as we checked them at 13:00 UTC on 25 September; since then all five XRP wallets and one 10,000 ETH wallet have been emptied. Zcash and TRON legs from Bitget's 25 September update, TRM Labs and our own on-chain checks on 28 September; other tracker figures from Lookonchain, MistTrack, Unchained and Bitcoin.com. Diagram: CTI Academy.

Start with what was taken. Bitget has listed the affected assets (XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX) but not the amount of each. Lookonchain's tally is the most complete public one:

That totals about $357 million. It includes about $7 million in TRX, which Bitget's first figure of $351.6 million left out, and it has no Zcash row at all. Bitget names t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG as the attacker's Zcash address; on-chain, it received 18,916.72 ZEC in two transfers on 24 September, and on 28 September it still held about 18,670 ZEC. Bitget's revised $387.5 million counts both legs. No tracker has reported BTC or SOL taken, and Bitget's asset list includes neither.

On the EVM side, speed. Stablecoins and tokenized gold are the only assets here that a central issuer can freeze. The attacker treated them like they were on fire. The USDT0 went in six minutes once it landed. USDT, USDC and XAUt left the main exploiter address, which Etherscan tags "Bitget Exploiter 1" and PeckShield flagged at 20:31, and were swapped into roughly 22,600 ETH in about 40 minutes, per Unchained. Stargate and cBridge carried side-chain funds back to Ethereum. By 23:39, per Lookonchain, most of the EVM take sat as 67,982 ETH, about $183 million. Not all of it moved that fast: about 8.2 million USDC bridged to Avalanche at 20:55 was still sitting there hours later.

Then the attacker stopped. Two fresh addresses received exactly 10,000 ETH each at 20:13 and 20:19, and a third received 4,590 ETH at 21:41. When we checked them at 13:00 UTC on 25 September, all three were untouched, holding 10,000, 10,000 and about 4,596 ETH. They were not the only ones: TRM Labs counts eight wallets that received most of the stolen ETH, most of them about 10,000 ETH each.

The pause lasted about two and a half days. At 07:40 UTC on 27 September the first 10,000 ETH wallet began paying out, mostly in lots of 25 to 300 ETH, to dozens of fresh addresses, and by 20:07 it was empty. One of the biggest recipients, 0xf7bC…96C3, is the address Lookonchain reported on 28 September swapping ETH into BTC through THORChain; we also see it bridging ETH out over Stargate. The second 10,000 ETH wallet started at 20:08 and still held about 2,880 ETH when we checked at 08:08 UTC on 28 September. The 4,596 ETH wallet had not moved, and four more 10,000 ETH wallets on Bitget's attacker list had never sent a transaction, which we confirmed on-chain.

On the XRP Ledger, patience. Three payments between 19:01 and 21:19 moved 102.98 million XRP from two Bitget-labeled wallets into one consolidation account. That account then split the XRP into four wallets of 20 million and one of about 22.98 million, and each received a 0.00001 XRP dust payment, an address-poisoning pattern. By 13:00 UTC on 25 September only one of the five had moved. It hopped funds through freshly created accounts and out through Bridgers, the SWFT cross-chain swap service, into ETH; about 1.62 million XRP had gone from it, and the other four held their full balances.

That changed on 26 September. By 12:41 UTC that day two of the 20 million XRP wallets had been all but emptied, per CoinDesk, and by 07:43 UTC on 27 September all five were empty or down to less than 25 XRP, which we confirmed on the ledger. Several of the next-hop accounts we sampled paid THORChain with swap memos that name Bitcoin addresses as the destination, so at least part of this XRP is being turned into BTC; the rest went on through further hops we have not traced. Across the 194 XRP Ledger addresses on Bitget's own attacker address list, only about 9,000 XRP remained on 28 September.

Why the difference? Native XRP cannot be frozen by anyone, so there was no clock. Stablecoins can be, and the clock was measured in minutes. The freezes identified so far prove the point. Circle blacklisted an exploiter address holding 99,990 USDC at 05:00 UTC on 25 September, and Tether followed for the 218,023 USDT in the same wallet, about $318,000 in all (CoinDesk). Bitget's own tracker put total frozen funds at about $339,000 on the morning of 28 September. Against $88 million in freezable assets, that is a rounding error. Bitget says "a few" chain foundations have frozen attacker addresses, but it has not named the chains or the amounts.

What has happened since: THORChain, then a mixer. MistTrack flagged Bitget exploiter funds going into THORChain at 08:36 UTC on 25 September. TRM Labs traced BNB Chain and Ethereum proceeds through THORChain into Bitcoin peel chains, and TRX swapped to USDT on SunSwap, bridged to Ethereum over USDT0 and sent the same way. On 26 September Chen formally asked THORChain to refuse service to the attacker's addresses; THORChain answered that it is decentralized and permissionless "like Bitcoin, Ethereum, and BNB Chain." That evening AMLBot traced about 4 BTC from the TRON leg into a Wasabi CoinJoin round. Bitget's tracker now lists about 1,000 attacker-linked Bitcoin addresses. No Tornado Cash or OTC desk has been publicly reported yet.

Correction, 28 September: an earlier version of this section said no THORChain use or conversion to BTC had been seen. MistTrack had already flagged THORChain use on the morning of 25 September.

This is the Bybit sequence. After Bybit, Elliptic documented stolen tokens swapped to ETH within minutes, then ETH pushed through eXch (a no-KYC swapper that has since shut down) and other services into BTC and on into mixers. Chainalysis describes North Korean laundering as running in waves over roughly 45 days, with most volume moved in tranches under $500,000 and a preference for Chinese-language money-movement services, bridges and mixers. If that holds here, the ETH still parked is not abandoned. It is queued. The last leg of that pipeline, cash-out through brokers and mules, is the same economy we mapped in our piece on bulletproof hosting and the money mule ecosystem.

Attacker Addresses for Screening

For compliance teams screening deposits. Verify against live trackers before acting; labels change quickly. Since 25 September Bitget itself publishes a live attacker address list, which on the morning of 28 September held more than 2,400 addresses across 16 chains, most of them downstream laundering hops; screen against that first. The table below keeps the addresses we traced ourselves on 24 and 25 September, plus the Zcash and TRON receiving addresses Bitget named later. Bitget's own victim wallets (rGDre…4GzFn, rwTTs…obXLEf) are deliberately not listed. Statuses are as of our on-chain checks on 28 September.

Addresses age fast. What will still be true next month is the behavior: freezable assets swapped at a premium within minutes, round-number tranches parked in fresh addresses, and a patient exit through swap services for the asset nobody can freeze.

Was It Lazarus? What the Evidence Actually Supports

Every headline says Lazarus. Here is what sits under that word.

What Bitget says. In the live Q&A, Chen said the team found "some IP addresses that match the VPN choices by a certain DPRK group." Bitget's written line is that "based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations" (The Hacker News; BleepingComputer). Bitget has also said it will not formally speculate until the investigation is complete.

What outside analysts say. At 00:53 UTC on 25 September, on-chain analyst Specter posted that the stolen XRP "was bridged and can be directly linked to the funds stolen in the AFX hack" (TechFlow carried the claim soon after). AFX lost $24.15 million from an Arbitrum custody bridge after a fake "Oddium Lab" recruiter lured a developer, and its post-mortem says its findings are "consistent with independent attribution" to UNC4899, also known as TraderTraitor (crypto.news).

Two blockchain analytics firms have since published. TRM Labs reports multiple on-chain overlaps between the Bitget proceeds and wallets used to launder earlier North Korean hacks, including Bybit and AFX Bridge, and says those links run through a laundering network it has not seen working for any other group, so they "point to TraderTraitor." It has not definitively attributed the theft and notes that another actor carrying it out "remains technically possible." Elliptic assesses the theft as "highly likely" DPRK-linked, citing the XRP connection Specter first reported, further links to addresses that laundered Bybit, and the laundering method.

What the method says. The mechanism fits a pattern this actor has used repeatedly. More on that in the next section.

Now weigh it, the way you would in a real assessment.

VPN IP overlap is weak evidence on its own. Commercial VPN exit nodes are shared by thousands of unrelated users, so "this IP was used by a DPRK group" is only meaningful if it came with a narrow time window or a matching session fingerprint, and we have not been told either. The AFX link, as Bitcoin.com's reading of the graph shows, runs through a single ETH wallet holding about $4,300. A shared swap service could produce exactly that overlap without a shared operator. TRM's and Elliptic's findings are broader than that one trace, but they are still laundering evidence: they show who is moving the money, not who was inside Bitget's network. Mandiant and SlowMist have not published any attribution findings; SlowMist's MistTrack has posted fund tracing only. ZachXBT, who referred to it in passing as a DPRK exploit, said he has no current plans to monitor the case, so his usual independent trace is missing too. And no government has attributed anything.

The method match and the laundering overlaps are now the two strongest legs, and both are arguments from pattern and money flow, not from evidence inside Bitget's network.

So our read on 25 September, in estimative language: DPRK responsibility is likely, on the combination of method, laundering behavior and victim profile. That it is TraderTraitor specifically is plausible but unconfirmed. What would move it to high confidence: an FBI public service announcement (the FBI named TraderTraitor for Bybit five days after the theft), Mandiant publishing malware or infrastructure overlaps, or laundering addresses converging with a known DPRK cluster. As of 28 September the third has happened, by TRM's and Elliptic's accounts, and the first two have not. Because it is laundering evidence, on its own it does not justify high confidence. But TRM, the only one of the two to name a cluster, says the laundering network has not been seen working for any group other than TraderTraitor, and on that basis we move TraderTraitor from plausible to likely in our read, alongside DPRK. Neither firm calls its attribution definitive. If you write this up for your own organization, our guide to writing a threat intel report nobody ignores covers how to carry that uncertainty without burying it.

"Lazarus" Is an Umbrella, Not a Group

"Lazarus Group" is how the press says "North Korean hackers." Inside the industry it is an umbrella over several distinct clusters that share a parent, the Reconnaissance General Bureau, but not necessarily operators, tooling or targets. The cluster that matters here goes by a different name at every vendor:

Mandiant assesses with high confidence that UNC4899 is a cryptocurrency-focused element within the RGB. Unit 42 calls Slow Pisces a spin-off from Lazarus. CISA's advisory AA22-108A introduced the TraderTraitor name in 2022, originally for the trojanized crypto apps the actor pushed, and tied the activity to Lazarus Group, APT38 and BlueNoroff. Google's July 2026 renaming moved several North Korean groups to NEPTUNE cryptonyms, but UNC4899 kept its UNC label, so the Mandiant name above is still current.

Why does the precision matter? Because Radiant Capital (2024) used a very similar signer-deception idea, and Mandiant attributes it to a different DPRK cluster, UNC4736, also tracked as Citrine Sleet. Drift (2026) assessed its own attacker as the same actor behind Radiant, and TRM Labs describes that actor as distinct from TraderTraitor. Different cluster, different lures, different malware, different detections. JPCERT/CC makes this argument directly: track at subgroup level, or your warnings go to the wrong sector. We unpack the whole naming problem, including how one CrowdStrike name maps to four Microsoft ones, in Threat Actor Naming, Decoded.

The Same Playbook: Attack the Signing Step, Not the Key

Line up the big DPRK crypto heists of the last two and a half years and ask one question of each: what did the signer see?

Figure 6: DPRK-linked thefts that attacked the signing step, by loss, with who made each attribution. Five times the attacker owned whatever told the signer what to sign; at AFX it owned the signers outright. Only Bybit was bigger than Bitget. Diagram: CTI Academy.

• DMM Bitcoin, May 2024, $308 million. An employee at wallet vendor Ginco ran a "pre-employment test" from a fake LinkedIn recruiter. The attacker later manipulated a legitimate DMM transaction request. The FBI, the DoD Cyber Crime Center and Japan's National Police Agency attributed it to TraderTraitor.
• WazirX, July 2024, more than $230 million. According to WazirX, its custody provider Liminal's interface showed signers one transaction while they signed another; Liminal disputes that and says WazirX's own devices were compromised. Either way, hardware wallets and a destination allow-list were in place and did not help. The US, Japan and South Korea jointly attributed the theft to North Korea.
• Bybit, February 2025, $1.5 billion. A Safe{Wallet} developer's machine was compromised and AWS session tokens were hijacked (Safe's findings, via The Hacker News), then JavaScript injected into Safe's web UI swapped the transaction only when Bybit's cold wallet was signing (NCC Group). The FBI named TraderTraitor.
• KelpDAO, April 2026, $292 million. Poisoned internal RPC nodes fed a forged message to a single verifier while still answering monitoring correctly (LayerZero).
• AFX, July 2026, $24 million. A malicious Git config on a developer's machine, a planted plugin in the JFrog artifact repository, then the validators themselves. AFX says implants on them co-signed the theft; Halborn says the attacker obtained five of seven validator keys. This is the variant in the list: the attacker did not deceive the signers so much as own them.
• Bitget, September 2026, $387.5 million (first estimated at $351.6 million). A compromised backend spoofed transaction data into the exchange's own authorization.

Six victims, six different technologies, one target: the signing step. The industry spent years hardening the key: HSMs, MPC, multisig, hardware wallets. The attacker moved one step upstream, to whatever produces the thing being signed.

The money this pays for is not abstract. Chainalysis counted $2.02 billion stolen by North Korea in 2025, $6.75 billion all-time, and attributed 76% of service compromises that year to DPRK actors. TRM Labs put DPRK at 76% of all crypto hack value in 2026 through April. The Multilateral Sanctions Monitoring Team counted at least $2.8 billion stolen between January 2024 and September 2025, and the US Treasury states plainly that revenue from digital-asset heists supports the WMD and ballistic missile programs. TRM now counts about $690 million stolen in hacks attributed to North Korea in 2026 through 16 September, and says that if Bitget is attributed too, the year passes $1 billion, second only to 2025 in its data. Elliptic, which counts Bitget as a suspected DPRK theft, already puts 2026 past $1 billion. That is with a quarter of the year left.

Mapping the Bitget Hack to MITRE ATT&CK

For detection engineers, here is the chain as ATT&CK techniques, with an honest status column. The initial-access, execution and supply-chain IDs follow Wiz's TraderTraitor analysis of the actor's past operations; the rest are our mapping, including the impact rows built from Bitget's own description.

Notice how much of the left side of the chain is "unknown." That is normal on day one, and it is the part a forensic report would fill in, if Bitget or its investigators publish one. Until then, hunt for the whole chain, not just the bit that made headlines.

What Exchanges and Defenders Should Change

None of this is exotic. It is the unglamorous work of refusing to trust your own plumbing.

Verify intent at the signer, independently. The signer, or a policy service sitting right beside it, should rebuild what it is about to sign from its own source of truth (the ledger of customer withdrawals, the treasury schedule) and refuse anything that does not match. If the only thing telling the signer what to sign is the system that was compromised, you have one point of failure wearing a hardware badge. LayerZero's KelpDAO report makes the same point about verifiers: no single data source, no single attester.

Enforce policy where the key lives, not in the UI. Destination allow-lists, per-asset and per-hour velocity caps, and a human quorum above a threshold. WazirX had an allow-list and still lost $230 million, because, by its own account, the lie happened in the interface above it. Policy that the signing cluster enforces itself survives a compromised dashboard.

Size hot wallets to hours, not days. Tiering limited Bitget's blast radius to the hot and warm layers, and that is worth something. But hot plus warm held more than $387 million. A warm tier that refills the hot tier under slower, separate approval, with a hard cap on what the hot tier can hold, turns a nine-figure loss into an eight-figure one.

Treat wallet backends, their deployment tooling and the vendor tools that touch them as tier zero. At AFX the path to the validators ran through a JFrog build server and an Ansible management service; at Bitget, by the CEO's account, it ran through a vulnerable third-party security product. Anything that can create, modify or relay a withdrawal, or deploy code to something that can, belongs in the same security tier as the keys: its own network, its own identity plane, change control, behavioral monitoring, and a vendor inventory you can actually cut off in minutes.

Harden the people near the signer. The recurring first step in this actor's operations is social: a recruiter, a coding test, a project to clone and run. Google's H1 2026 cloud threat reporting described a suspected UNC4899 intrusion that began with a file AirDropped from a personal device to a work laptop. SentinelOne has seen weaponized Terraform lock files. No take-home tests or unknown repositories on machines that can reach wallet infrastructure, full stop. The persuasion techniques behind those lures are covered in our breakdown of the psychological tactics used in social engineering.

Pre-wire the freeze. The USDT0 was gone in six minutes. Outflow anomaly alerting needs to fire in seconds, and the phone numbers for Tether, Circle and the relevant chain foundations need to be in the runbook before the incident, not found during it. Who can freeze which token, how long the freeze window stays open and what a referral must contain to get funds frozen are covered in our crypto tracing and fraud intelligence path.

For threat intelligence teams: track the cluster, not the umbrella. A "Lazarus" watchlist that mixes TraderTraitor, UNC4736 and the fake IT worker schemes will give you the wrong lures to train on and the wrong infrastructure to block. Screen inbound deposits against Bitget's live attacker address list as well as the addresses above, and expect the ETH still parked to keep moving in waves, as it began to on 27 September.

What We Still Don't Know

An honest incident write-up says where the edges are.

• The root-cause report. Chen's first notice promised a full incident report with root cause analysis within 24 hours. As of 28 September Bitget says it has identified the attack path and fixed the vulnerability, and Chen says the details will come in a formal security report, but it has not been published.
• Initial access. The CEO's answer, as of her 28 September livestream, is a vulnerability in a third-party security product that let the attackers steal intranet credentials. Which product, how it was breached, and how long the attacker sat inside it are all still open.
• The vendor. If the supply chain account is confirmed, Bitget joins Bybit (Safe{Wallet}) and DMM Bitcoin (Ginco) in the came-through-a-vendor column, and every other customer of that product has a problem too.
• The outflow window. Why transfers to the attacker were still landing on the XRP Ledger and Zcash at 21:19 if the response team was active within minutes.
• Per-chain figures from Bitget. Bitget now lists the affected chains and assets, including Zcash and TRON, but not the amount taken on each.
• The AFX link. TRM and Elliptic report overlaps with earlier DPRK laundering, including AFX Bridge and Bybit. Mandiant and SlowMist have not published attribution findings.
• Official attribution. Whether the FBI publishes a PSA, as it did for Bybit five days after that theft. None had appeared by 28 September.
• Recovery. Bitget's tracker shows about $339,000 frozen. Most of the rest now sits in ETH, BTC and ZEC, which no issuer can freeze, so recovery depends on catching funds at exchanges and swap services, which Bitget's 5% bounty is meant to encourage.

We will update this article if Bitget publishes its promised incident report or its investigators release findings. For the daily picture in between, todayincyber.io aggregates the coverage as it comes in.

Reading an Incident Like an Analyst

Anyone can repeat "Lazarus stole $387 million." The analyst's job starts at "how do we know, how sure are we, and what does it change for us." That means separating a victim's preliminary claim from a government attribution, reading a fund-flow graph for intent rather than just totals, and turning a headline into three controls someone can deploy on Monday.

Theory teaches you the frameworks. Judgment comes from reps: reading raw artifacts, weighing sources that disagree, writing the assessment and stating how sure you are. That is what CTI Academy's Threat Actor Profiling & Attribution learning path is built around: you grade evidence, weigh competing hypotheses and state a confidence you can defend, and it teaches the refusal as well as the claim, because sometimes the evidence will not carry a name. If you want to build that judgment by working an unnamed activity cluster from infrastructure to a finished actor profile, start the Threat Actor Profiling & Attribution path. And if you are new to the field, our pillar guide on what cyber threat intelligence actually is is the right first stop.

Frequently Asked Questions

What happened in the Bitget hack?

On 24 September 2026, attackers stole about $387.5 million from Bitget's hot and warm wallets; Bitget's first estimate was $351.6 million. According to Bitget, they compromised a backend system in the exchange's wallet infrastructure, used it to spoof transaction data, and triggered Bitget's own authorization process to send funds out across nine blockchains. Cold wallets were not affected.

How much was stolen in the Bitget hack?

Bitget puts the loss at about $387.5 million. It first said $351.6 million, then revised the figure on 25 September after counting Zcash and TRON transfers from the same incident that its first estimate had missed; it says the increase is not new theft. The largest pieces, per blockchain trackers, are roughly 102.9 million XRP (about $157 million) and 31,890 ETH (about $86 million), plus USDT, USDC, USDT0, tokenized gold, BNB, AVAX, TRX and about 18,900 ZEC.

Was the Bitget hack carried out by the Lazarus Group?

It is suspected, not confirmed. Bitget says the method is "highly consistent" with North Korean hacker groups, citing VPN IP addresses and on-chain patterns. TRM Labs and Elliptic report that the stolen funds touch wallets used to launder earlier North Korean thefts, including Bybit, which TRM says points to TraderTraitor, a North Korean cluster often lumped under "Lazarus." No government has attributed the attack, and Mandiant and SlowMist have not published findings.

Are Bitget users' funds safe after the hack?

Bitget says customer balances are fully covered by its User Protection Fund, which held over $464 million when the incident happened, and that cold wallets were untouched. Deposits and trading continued throughout. Withdrawals were paused and are reopening in phases: BTC from 28 September, ETH on 29 September, USDT on 30 September and all other assets on 2 October; BTC withdrawals reopened on schedule on 28 September. The revised $387.5 million loss equals about 84% of that fund, and CEO Gracy Chen said in a 28 September livestream, as reported by TechFlow and PANews, that Bitget plans to refill it to at least its $300 million baseline within a week.

How did hackers steal from Bitget without the private keys?

They attacked the pipeline above the keys. The attacker controlled a backend system that feeds Bitget's authorization process, by the CEO's account through a vulnerability in a third-party security product, forged the transaction data it passed along, and let Bitget's own signing infrastructure approve and sign the transfers. According to Bitget, the keys worked exactly as designed; the instructions they received were fake.

What is TraderTraitor?

TraderTraitor is the US government's name for a cryptocurrency-focused North Korean hacking cluster, tracked by Mandiant as UNC4899, by Microsoft as Jade Sleet and by Palo Alto Networks Unit 42 as Slow Pisces. It is part of the broader "Lazarus" umbrella under North Korea's Reconnaissance General Bureau, and the FBI has attributed the Bybit and DMM Bitcoin thefts to it.

How is the Bitget hack different from the Bybit hack?

Bybit lost about $1.5 billion from a cold wallet in February 2025 after attackers compromised a third-party vendor, Safe{Wallet}, and altered what Bybit's signers saw in the web interface. Bitget lost about $387.5 million from hot and warm wallets through a compromised backend inside its own wallet infrastructure. The shared idea is signer deception: in both cases the keys signed what they were shown, and what they were shown was forged.

Can the stolen Bitget funds be frozen or recovered?

Only partly. Stablecoin issuers can freeze their tokens, and Circle and Tether have frozen about $318,000 in USDC and USDT at one exploiter address; Bitget's tracker showed about $339,000 frozen in total on 28 September. The attacker swapped most freezable assets into ETH within about 90 minutes, and native XRP, the largest single asset taken, cannot be frozen by anyone; it has since left the attacker's holding wallets, and part of it has been swapped into Bitcoin through THORChain. Bitget offers a 5% bounty for freezes and recoveries, and recovery will depend on catching funds at swap services, exchanges and OTC desks as they are laundered.

Sources

Bitget (primary) - Bitget Support Center: Security notice, 24 Sep 2026 - Gracy Chen on X: Security notice, 24 Sep 2026 - Gracy Chen on X: Technical update, 25 Sep 2026 - Gracy Chen on X: 12-hour summary, 25 Sep 2026 - Bitget on X: Mandiant and SlowMist engaged, 25 Sep 2026 - Gracy Chen on X: Revised figure, bounty and withdrawal plan, 25 Sep 2026 - Bitget Support Center: Latest incident update, fund tracing and Recovery Bounty Program, 25 Sep 2026 - Bitget Support Center: Bitget to resume withdrawals in phases, 26 Sep 2026 - Bitget Support Center: CEO livestream announcement, 28 Sep 2026 - Bitget Support Center: Bitget announcement on resuming BTC withdrawals, 28 Sep 2026 - Bitget Stolen-Funds Tracker and attacker address API - Gracy Chen on X: Request to THORChain, 26 Sep 2026

Incident reporting and on-chain analysis - The Hacker News: Bitget says suspected North Korean hackers stole $351.6M - BleepingComputer: Hackers steal $351.6 million in Bitget crypto exchange hack - CoinDesk: Bitget says $352 million affected in a hack - CoinDesk: Bitget's hack happened via spoofed transfers, not private keys - Cointelegraph: Bitget CEO suspects North Korea, citing IP clues - Decrypt: Bitget hacked as funds vanish from exchange wallets - WuBlockchain: Bitget hacked suddenly, timeline recap - Unchained: Bitget's hot and cold wallets hit in suspected hack (early report; Bitget says cold wallets were not affected) - Bitcoin.com News: $157M in stolen XRP sits in wallets no one can freeze - CryptoSlate: Bitget's hack could drain 76% of its protection fund - ChainCatcher: Circle freezes USDC linked to the Bitget attacker - Specter on X: Bitget XRP linked to AFX hack funds - TechFlow: Specter links Bitget's stolen XRP to AFX hack funds - TechFlow: Behind Bitget's $351 million hack, supply chain attacks resurface - Lookonchain on X: 67,982 ETH consolidated - Lookonchain on X: Stolen asset breakdown - PeckShield on X: Exploiter address flagged - The Crypto Times: ZachXBT will not monitor the Bitget hack - TRM Labs: Bitget loses USD 351.6 million in hot wallet breach in likely North Korea attack - Elliptic: Bitget attack pushes suspected North Korea crypto heists over $1 billion in 2026 - Decrypt: Bitget hack losses climb to $387M - The Record: Crypto CEO accuses North Korea of stealing $387 million from Bitget - CoinDesk: Circle and Tether freeze hacker wallet after Bitget heist - CoinDesk: Bitget hacker moves $83 million in stolen XRP - The Crypto Times: Bitget withdrawals resume September 28, full schedule - MistTrack on X: Bitget exploiter funds sent into THORChain, 25 Sep 2026 - THORChain on X: Reply to Bitget, 26 Sep 2026 - AMLBot on X: Bitget funds enter Wasabi CoinJoin, 26 Sep 2026 - Odaily, citing Lookonchain: Bitget hacker swaps ETH for BTC through THORChain, 28 Sep 2026 (in Chinese) - TechFlow: Bitget CEO says the incident came from a third-party security product vulnerability, 28 Sep 2026 - PANews: Bitget CEO on the livestream of 28 Sep 2026

Actor profile and precedents - FBI IC3: North Korea responsible for $1.5 billion Bybit hack - FBI, DC3 and NPA: TraderTraitor responsible for $308M DMM Bitcoin theft - CISA AA22-108A: TraderTraitor - Mandiant: North Korea leverages SaaS provider in supply chain attack (UNC4899) - Unit 42: Slow Pisces targets developers with coding challenges - Wiz: TraderTraitor deep dive - JPCERT/CC: Classifying Lazarus subgroups - NCC Group: In-depth technical analysis of the Bybit hack - US, Japan and ROK: Joint statement on DPRK cryptocurrency thefts - Cointelegraph: Liminal disputes WazirX's account of the hack - The Hacker News: Safe{Wallet} confirms TraderTraitor behind Bybit - Halborn: Explained, the AFX bridge hack - Unit 42: Threat actor groups tracked by Palo Alto Networks - LayerZero: KelpDAO incident report - crypto.news: AFX post-mortem and attribution - The Hacker News: UNC4899 breached crypto firm via AirDrop - SentinelOne: TraderTraitor backdoors resurface

Scale and funding - Chainalysis: 2025 crypto theft, North Korea drives record year - TRM Labs: North Korea stole 76% of all crypto hack value in 2026 - Elliptic: The Bybit hack money trail - US State Department: MSMT report on DPRK cyber activity - US Treasury: Sanctions on DPRK bankers laundering cybercrime proceeds