North Korean Hackers Suspected in $351 Million Bitget Exchange Heist

North Korean hackers are suspected of stealing more than $351 million from cryptocurrency exchange Bitget during a cyberattack on Thursday, making it the largest known digital currency heist of the year.

The attack targeted Bitget's hot wallets — wallets connected to the internet and used for active trading. Bitget disclosed the breach in a series of posts on X on Thursday and Friday, describing it as an unauthorized transfer of crypto from those wallets. The company has suspended crypto withdrawals on its network.

Bitget has $464 million in its user protection fund, the company said, which should cover the costs of the theft.

Bitget chief executive Gracy Chen attributed the attack to state-linked actors. The breach and heist was "highly consistent with known patterns of North Korean hacker organizations," Chen said.

Such collectives have been linked to crypto thefts before. They have also been suspected of targeting open-source software to mass-hack victims, with the aim of funding North Korea's nuclear weapons program.

Blockchain intelligence firm TRM Labs puts the scale of Pyongyang's activity in context. According to TRM Labs, North Korea is behind around three-quarters of all crypto thefts during 2026 to date.

The Largest Heist of a Busy Year

The Bitget attack eclipses the previous record for 2026: a $340 million hack in September. In that incident, the hacker returned all but $47 million of the stolen funds — an unusual outcome in a sector where recovery rates are typically low.

The Bitget breach is the latest in an ongoing spate of high-profile hacks targeting the crypto sector. The pattern underscores a persistent structural weakness in exchange security: hot wallets, precisely because they remain internet-connected to serve active traders, present an attractive attack surface for well-resourced and patient adversaries.

The scale of the suspected perpetrator matters as much as the sum. If the North Korea attribution holds, the theft fits a documented strategy of converting stolen digital assets into hard currency for the country's weapons programs — a use case that puts crypto exchange security in the domain of national security concerns rather than purely commercial risk.

Withdrawals Suspended, Timeline Unclear

Bitget's immediate response has been defensive. The exchange suspended withdrawals across its network after detecting the unauthorized transfers. Chen did not say when withdrawals would open again.

The company's user protection fund, at $464 million, exceeds the $351 million stolen. That cushion, if deployed fully and quickly, would spare Bitget's customers from direct losses. It does not, however, undo the operational disruption of a prolonged withdrawal freeze — or the reputational damage that follows a nine-figure breach.

The Numbers Behind the Threat

The figures frame the challenge for the industry. A single attack drained $351 million. North Korean groups account for roughly three-quarters of all crypto stolen in 2026 so far, according to TRM Labs. The September hack, at $340 million, ranks as the year's second-largest — and even that incident ended with $47 million still gone.

For Bitget, the immediate questions are operational: when withdrawals resume, how the protection fund is applied, and whether the exchange can restore trader confidence. For the broader market, the Bitget heist confirms that exchange hot wallets remain the softest target in crypto — and that the adversaries probing them are state-backed, funded and unlikely to stop.