Bitget Confirms $387.5M Hack, Spoofed Transfers Implicate North Korea

What happened: Crypto exchange Bitget suffered a $387.5 million breach, initially reported at $351.6 million, after attackers compromised backend wallet infrastructure and injected spoofed transaction data. The hack, detected on September 24, impacted EVM chains, XRP Ledger, Zcash, and TRON, with losses in XRP, ETH, USDT, ZEC, USDC, BNB, AVAX, and TRX. CEO Gracy Chen stated that private keys were not compromised and containment measures are in place. Preliminary evidence, including VPN IPs, points to North Korean hacker groups, though attribution remains unconfirmed. Bitget’s $464M User Protection Fund will cover user losses; withdrawals are paused but trading remains open.

Why it matters: This is 2026’s largest confirmed exchange hack, though still below Bybit’s $1.5B loss in 2025. The attack highlights evolving threat vectors—specifically, backend infrastructure vulnerabilities rather than traditional private key theft. North Korea’s suspected involvement underscores the persistent geopolitical risk in crypto security, with 2025 estimates pegging DPRK-linked theft at $2.02B. The rapid containment and user fund coverage may set a precedent for crisis response, but some analysts warn that supply-chain risks remain underappreciated. Source: Cointelegraph, CoinDesk, CNBC