Bitget’s $357 mn crypto hack linked to North Korea, crypto theft tops $1 bn

Elliptic, a blockchain analytics firm, said the crypto exchangeBitget attack shares characteristics with previous incidents attributed to North Korean groups. Investigators found similarities in the movement and laundering of stolen assets, along with on-chain connections to addresses associated with earlier attacks.

A $357 mn hack of Bitget was likely carried out by North Korea-linked hackers, pushing DPRK-attributed digital asset theft above $1 bn this year.

Some funds were linked to addresses connected with previous crypto thefts, including the $1.5bn Bybit attack in 2025. Elliptic said early laundering patterns and on-chain overlaps point toward TraderTraitor, a North Korea-linked group associated with previous crypto exchange attacks.

Elliptic has tracked more than 50 security incidents associated with North Korea during 2026, representing around $1.2bn in stolen digital assets. The Bitget breach pushed its total estimate for DPRK-linked crypto theft this year past $1bn.

North Korean groups have stolen billions of dollars in cryptocurrency since 2017, with digital asset theft becoming an important source of revenue for the sanctions-hit country.

Crypto exchanges remain attractive targets because large amounts of digital assets sit in connected wallet infrastructure and stolen funds move quickly between networks.