North Korea named as primary suspect in $387 million Bitget crypto hack — investigators identify IP addresses tied to VPN infrastructure previously used by North Korean hacker groups; thieves swapped stablecoins for ETH in minutes to dodge freezes

North Korea may be behind a hack that drained over $387 million from crypto exchange Bitget, according to the company’s CEO Gracy Chen. Speaking during an X livestream on the evening of the September 24 hack, Chen said that the attack — the biggest in 2026 so far — bore the hallmarks of North Korean state-sponsored threat actors, citing suspicious IP addresses tied to VPN infrastructure previously used by North Korean hacker groups.

According to Chen, Bitget detected abnormal transfers from some hot wallets on Thursday afternoon Eastern time. The hackers exploited a backend wallet system that processes wallet transactions, forging transfer approvals that tricked the system into authorizing the fraudulent transactions. She confirmed that cold wallets and private keys remained safe and uncompromised. The stolen assets include Ether, XRP, USDT, USDC, Avalanche, and BNB across the Ethereum, XRP Ledger, Avalanche, BSC, and Arbitrum networks. Early independent on-chain analysis initially put the total stolen value at $170 million to $183 million, before Bitget announced an initial official value of $351.6 million. Comprehensive audits revised the final official value to $387.5 million.

Bitget temporarily froze user withdrawals, while deposits and trading remained functional. The company announced that its over $464 million User Protection Fund would cover the full loss. It says it has fixed the backend vulnerability and is rolling out a staggered withdrawal schedule — starting Monday, September 28 — to manage network traffic and ensure complete infrastructure security.