Bitget Hack Pushes Suspected DPRK Theft Past $1B in 2026

A single exchange incident has changed the risk picture for every finance team holding digital assets on a centralized venue. Bitget lost more than $350 million in unauthorized transfers from its hot and warm wallets, and blockchain analytics firm Elliptic says multiple indicators point to the Democratic People's Republic of Korea (DPRK). For teams that rely on crypto accounting software to track balances, counterparties and losses, the practical question is simple: could you tell, within hours, whether you were exposed?

This article sets out what has been reported, what remains unconfirmed, and what the incident means for accounting, tax and AML workflows. It is written for accounting firms, auditors and CFOs, with notes for individual filers where their position differs.

What happened at Bitget

The incident and the timeline

According to Elliptic, Bitget detected unauthorized transfers from its hot and warm wallet infrastructure at about 18:31 UTC on 24 September 2026. The affected assets were varied: ETH, XRP, BNB, AVAX, USDT and USDC were named, moving across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base networks. Bitget reported that cold storage was not affected, and it suspended withdrawals as a precaution.

The spread of assets and chains matters for anyone doing reconciliation work. A loss that touches six or seven networks and several token types is not a single wallet to flag. It is a set of addresses on many ledgers, and any exposure analysis has to cover all of them.

How the attackers got in, according to the exchange

Bitget's CEO, Gracy Chen, said the incident did not involve a private key compromise. Her description was that attackers compromised a backend system inside the wallet infrastructure and used it to spoof transaction data. She also said the attack was consistent with techniques used by DPRK-linked hacker groups, and in a later briefing described the perpetrator as likely a North Korean group.

One caveat deserves emphasis. Elliptic notes that the exchange's own technical basis for that attribution has not yet been published. The attribution is therefore a strong working assessment built on on-chain and off-chain indicators, not a formal finding by a government or court. Finance teams should record it as suspected, and avoid wording in documentation that treats it as established.

Bitget's stated response

Bitget has said its User Protection Fund fully covers the loss. That is a statement from the exchange, and the source does not detail the size of the fund or how and when customers would be made whole. For anyone with balances on the platform, the stated coverage is relevant to disclosure and to any provision judgment, but it is not the same as a confirmed recovery. It should be treated as a claim to be verified against the exchange's own communications as they develop.

Why analysts link the attack to North Korea

On-chain connections to earlier exploits

Elliptic reports that connections have been observed between XRP from the Bitget exploit and ETH from a previous DPRK-attributed exploit. It also saw links between the stolen Bitget funds and addresses used to launder earlier DPRK-attributed thefts, including one in 2025. In Elliptic's reading, shared laundering infrastructure across incidents is a recurring feature of DPRK laundering, with launderers favouring speed over operational discipline.

Laundering behaviour consistent with past cases

The stolen funds were converted quickly out of stablecoins and other non-native tokens into each chain's native asset, a technique Elliptic describes as consistent with DPRK laundering. The one exception also points the same way: assets on Arbitrum were rapidly moved across chains to Ethereum, which Elliptic suggests may reflect lessons learned from the KelpDAO laundering, where the Arbitrum Security Council acted to freeze 30,766 ETH.

For a compliance team, that detail is a reminder that freezes are one of the few effective countermeasures, and that attackers adapt to them. Speed of detection matters because the window in which funds can be frozen is short.

The 2026 totals in context

Elliptic says the incident would be the largest single cryptoasset theft attributed to North Korea in 2026, a year in which it has already tracked more than 51 DPRK-linked incidents. Its tracked total of DPRK-attributed theft for the year now exceeds $1 billion. The source also lists major centralized exchange and bridge hacks of recent years that were ultimately attributed to DPRK-linked actors, summarised below.

The pattern is the point. Attribution to DPRK-linked actors has followed most of the largest centralized venue and bridge incidents, so treating this as a rare event in risk models is no longer defensible.

What it means for accounting and audit teams

Exposure mapping and counterparty records

The first task after any exchange incident is knowing who holds what, where. Firms that keep exchange balances in spreadsheets, or in separate unreconciled exports, struggle to answer that question quickly. Good digital asset accounting software lets you tag each balance by custodian, wallet, chain and asset, so that a venue-level event can be filtered in minutes rather than days.

In practice, that means being able to report, for any date, the amount held on a named exchange, the proportion that sits in custody versus self-held wallets, and the clients or entities that own it. For an accounting firm serving multiple clients, the same view per client is essential. Our earlier piece on spotting exposure after an exchange hack walks through the same approach in another incident.

Recognising a loss, a receivable or a contingency

Whether a hack produces an accounting loss for a customer depends on facts the source does not settle: the contractual relationship with the exchange, whether the customer retains a claim on the platform, and how and when any compensation is delivered. Bitget's statement that its protection fund covers the loss is relevant, but a stated intention is not a settled recovery.

The sensible discipline is to document the facts at the reporting date, assess whether the balance is still recoverable from the exchange, and apply the framework your entity reports under to decide between continued recognition, impairment, a receivable or a disclosed contingency. Because those frameworks differ by jurisdiction and entity type, firms should agree the treatment with the engagement partner and, where relevant, the auditor, and keep a clear audit trail showing what was known and when.

Audit evidence and subsequent events

For auditors, an incident close to a year-end or interim date can be a subsequent event or a condition to evaluate at the balance sheet date. Evidence worth requesting includes exchange statements, withdrawal-suspension notices, written confirmation of protection-fund coverage, and wallet-level reconciliations before and after the incident date. A system that preserves historical balances with time stamps makes that evidence far easier to produce.

Compliance and AML implications

Screening against newly designated addresses

Elliptic says it urgently updated its datasets to reflect addresses linked to the incident, and that its customers can screen against them now. The wider lesson, which applies whichever screening provider a firm uses, is that address lists change fast after an incident. Teams should confirm how quickly their screening and monitoring sources are updated, and who is responsible for reviewing new designations.

Where your firm or client receives funds, even indirectly, a transfer from an address connected to a suspected state-linked theft is a high-risk event. Procedures should say what happens next: hold, escalate, document the rationale, and decide whether a suspicious activity report or equivalent filing is required under local rules.

Sanctions and reputational risk

DPRK-linked activity is a sanctions-sensitive area. Even where attribution is still suspected rather than confirmed, the prudent course is to apply heightened due diligence to any flows that touch addresses tied to the incident, and to keep contemporaneous records of the checks performed. Our related coverage of the Bitget attack and the $1 billion DPRK threshold covers the AML angle in more detail.

Why shared laundering infrastructure helps investigators

The reuse of laundering infrastructure across incidents is, in Elliptic's description, a sign that launderers are prioritising speed over discipline. That is useful for investigators, because earlier cases give a map of likely cash-out routes. It is also useful for compliance teams, because screening rules built on earlier incidents may catch part of the new flow.

Practical next steps for firms and individual filers

For accounting firms, auditors and CFOs

• Run a venue-level exposure report: balances by exchange, chain and asset, for each client or entity.
• Check whether any balances sit on Bitget, and record the date and status of the withdrawal suspension.
• Obtain and file written communications from the exchange about the protection fund and any compensation process.
• Review screening sources and update procedures for newly designated addresses.
• Agree and document the accounting treatment with the engagement partner before the next reporting date.
• Update the risk register: counterparty concentration on a single custodian is now an evidenced, recurring exposure.

Teams working on wider risk frameworks may also find our guidance on crypto compliance reporting a useful reference point for structuring these controls.

For individual filers

If you've got coins on Bitget, don't rush to file anything or to record a loss. The exchange says its fund covers the shortfall, and that matters for whether you've actually lost anything. Keep screenshots of your balance, any emails from the exchange, and your transaction history. Tax rules on theft and loss differ by country, and many treat unrealised or recoverable balances differently from realised losses, so check with a tax adviser before you claim anything. A tidy export from your bookkeeping tool will save time whatever the outcome.

What to watch next

Three things remain open in the source: the exchange's technical basis for attributing the attack to a North Korean group, the details and timing of any compensation under the User Protection Fund, and any formal government statement. Each can change the accounting and AML position, so set a review date and revisit the file when any of them moves.

Choosing tools that cope with a venue-level event

What good crypto bookkeeping software should do

An incident like this is a stress test of record-keeping. Good crypto bookkeeping software should preserve a per-venue history of balances, link every transaction to a wallet and chain, keep an immutable audit trail, and export evidence in a form an auditor accepts. The aim is not to predict the next hack but to cut the time between an alert and a defensible answer.

Connecting the tooling to policy

Software helps only if the policy behind it is clear. Decide in advance who investigates an alert, who approves a treatment decision, and how quickly the client is told. Recording those responsibilities now means that the next incident, which the year's pattern of 51 or more DPRK-linked events makes plausible, is handled with a checklist and not with improvisation.

FAQ

Has North Korea been confirmed as responsible for the Bitget attack?

Not formally. Elliptic says multiple indicators point to DPRK, and Bitget's CEO has said the attack was consistent with DPRK-linked techniques and that the perpetrator was likely a North Korean group. The exchange's own technical basis has not yet been published, so the attribution should be recorded as suspected.

How much was stolen and which assets were affected?

Elliptic reports more than $350 million in unauthorized transfers from hot and warm wallets. The assets named include ETH, XRP, BNB, AVAX, USDT and USDC, across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base networks. Cold storage was reported unaffected.

Does the protection fund mean customers have no loss to record?

Bitget says its User Protection Fund fully covers the loss, but that is the exchange's statement. Whether a customer has an accounting loss, a receivable or a contingency depends on the contractual position and on how recovery actually unfolds, so treatment should be agreed with your adviser or auditor.

How can crypto accounting software help after an exchange hack?

It lets you filter balances by custodian, wallet, chain and asset to size exposure quickly, preserves time-stamped history for audit evidence, and supports an audit trail for any treatment decision. It does not replace professional judgment on recognition or on AML escalation.

What should compliance teams do with the newly linked addresses?

Confirm your screening provider has loaded the new designations, review recent inbound and outbound flows against them, and escalate any hits under your procedures. Keep dated records of the checks, since attribution is still developing.

Source: Elliptic