Cybersecurity
Bitget says hackers stole $351.6m after backend compromise
Bitget said suspected North Korean hackers took $351.6 million from hot and warm wallets, paused withdrawals, and brought in Mandiant and SlowMist while it reviewed the incident.
- Bitget said its security systems detected unauthorised transfers at 18:31 UTC on 24 September 2026.
- The company said its cold wallets and most platform assets were unaffected, and that customer balances, deposits and trading continued normally.
- Bitget suspended withdrawals while it carried out a security review and used Mandiant and SlowMist in the investigation.
- Gracy Chen said the affected assets included several cryptocurrencies and that some chain foundations had frozen hacker wallet addresses.
Bitget said suspected North Korean threat actors had stolen $351.6 million from its hot and warm wallets. It said the transfers were detected at 18:31 UTC on 24 September 2026.
The company said its cold wallets and the bulk of its platform assets remained secure. It also said customer balances were accurate, deposits and trading were still operating, and withdrawals had been paused while it reviewed the incident.
Bitget said it had not given details of the method used, but had brought in Mandiant and SlowMist to investigate. It also said Bitget Wallet was on separate infrastructure and had not been affected.
Gracy Chen said the affected assets included ETH, XRP, BNB, AVAX, USDT and USDC across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. She said some foundations had confirmed the freezing of hacker wallet addresses.
Chen also said the attacker had compromised a backend system in the wallet infrastructure, used it to alter transaction data, and triggered the authorisation process to move funds out. Bitget said it did not expect further unauthorised transfers.
Named in this story
People
- Gracy Chen
- Bitget’s chief executive who commented on the affected assets and attack pattern
Companies
- Bitget
- said suspected North Korean hackers stole funds and suspended withdrawals
- Mandiant
- was enlisted with SlowMist for a third-party investigation
- SlowMist
- was enlisted with Mandiant for a third-party investigation
Products and systems
- Bitget Wallet
- was described as separate from Bitget Exchange and unaffected
- Ethereum
- was one of the chains linked to the affected assets
- XRP Ledger
- was one of the chains linked to the affected assets
- Arbitrum
- was one of the chains linked to the affected assets
- Avalanche
- was one of the chains linked to the affected assets
- Optimism
- was one of the chains linked to the affected assets
- BSC
- was one of the chains linked to the affected assets
- Base
- was one of the chains linked to the affected assets
How the source tells it
The piece was a straight incident report built from Bitget’s statements and contained no distinct emotive framing.
No emotive framing was found in the original.