North Korea Accused of Draining $387 Million From Bitget

Crypto exchange Bitget lost more than $387 million in a security breach on Thursday night — the largest cryptocurrency hack of the year to date.

During a three-hour livestream on X, CEO Gracy Chen said Bitget suspects North Korean attackers exploited a backend system used to process wallet transactions, making fraudulent withdrawals appear legitimate. The attackers did not steal private keys, the secret digital credentials used to move crypto. Instead, they tricked Bitget's internal approval system into authorizing the transfers.

Bitget said it has fixed the vulnerability and paused withdrawals while it continues to review the platform's security. The revised loss estimate reflects additional transactions identified on networks including the privacy-focused Zcash blockchain and TRON, which is widely used for stablecoin transfers.

BGB, Bitget's native token, dropped almost 7% to $1.93. It has since recovered slightly and was trading at $1.97.

Chen said the unauthorized transfers were limited to Bitget's hot and warm wallets — company-controlled pools of crypto used to process customer trades and withdrawals. Bitget Wallet, a separate self-custodial product in which users control their own crypto rather than the exchange, was not affected.

North Korea has become one of the crypto industry's most prolific hacking threats. North Korean-linked hackers stole a record $2 billion in cryptocurrency in 2025, according to blockchain analytics firm Chainalysis. The country is widely believed to use crypto theft to generate hard currency amid international sanctions that restrict access to conventional banking and foreign investment.

Chainalysis said these groups increasingly target exchanges and other large crypto firms by placing IT workers inside companies, posing as recruiters to steal credentials and approaching executives with fake investor pitches. The Bitget breach fits that pattern of direct attacks on exchange infrastructure.

Since the breach, Bitget announced a partnership with third-party experts Mandiant and SlowMist to investigate the incident. The exchange also launched a recovery-bounty program offering rewards of up to 5% for funds successfully frozen or recovered, and released a real-time tracking dashboard intended to help outside researchers and other platforms identify the attacker's wallets.

Bitget said its user protection fund, a reserve intended to compensate customers for losses from security incidents, holds more than $464 million — enough to cover the current loss if the stolen funds cannot be recovered.

The hack is the latest in a series of breaches to hit the crypto sector over the past three months. Earlier this month, Liquid Network, a secondary blockchain designed to facilitate Bitcoin transactions, suffered a $319 million security breach. In late July, Coldcard, a hardware wallet, was hit in a separate attack that drained about $116 million in Bitcoin. That incident raised particular alarm because Coldcard devices are designed to keep users' Bitcoin keys offline, one of the methods widely considered safest for storing cryptocurrency.

With three nine-figure breaches in roughly three months — two of them striking infrastructure designed to be among the industry's most secure — the question facing exchanges is no longer whether attackers can penetrate their systems, but how quickly the industry's reserves and recovery mechanisms can absorb the losses.