Bitget Hack: What Crypto Accounting Software Must Cover

A suspected North Korea-linked attack on Bitget has pushed the total of crypto thefts attributed to the DPRK in 2026 past $1 billion, according to blockchain analytics firm Elliptic. For finance teams, the so-what is practical: if you hold or custody digital assets on exchanges, your crypto accounting software and your internal procedures need to handle exposure tracking, loss events, address screening and audit evidence before an incident, not after one.

What happened at Bitget

The incident timeline and scale

Bitget detected unauthorized transfers from its hot and warm wallet infrastructure on 24 September 2026, at around 18:31 UTC. Elliptic puts the value at more than $350 million. The affected assets were spread across a long list of tokens and networks: ETH, XRP, BNB, AVAX, USDT and USDC, moving across Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base.

The exchange's cold storage was reportedly unaffected. As a precaution, Bitget suspended withdrawals. Its CEO, Gracy Chen, said the loss is fully covered by the exchange's user protection fund.

How the attackers got in

According to Chen's public update, no private key was compromised. Instead, attackers reportedly broke into a backend system inside Bitget's wallet infrastructure and used it to forge transaction data. That distinction matters for anyone assessing counterparty risk. A leaked key is a well-understood failure. A compromised backend that can make the system believe a withdrawal is legitimate is a failure of process and architecture, and it can exist even where key management looks strong on paper.

Chen also said the attack matches techniques used by North Korea-linked hacking groups. Elliptic notes that the technical basis for that attribution has not yet been published by the exchange, so the public record rests on Bitget's statement plus Elliptic's own on-chain and off-chain analysis.

Why Elliptic links the theft to the DPRK

On-chain connections

Elliptic says it flagged the exploit addresses shortly after the first alerts. It found links between XRP taken in the Bitget exploit and ETH from an earlier exploit attributed to North Korea. It also found further connections between the stolen Bitget funds and addresses used to launder proceeds of earlier DPRK-attributed thefts, including one from 2025. Reuse of laundering infrastructure across incidents is, in Elliptic's reading, a recurring feature of DPRK-linked laundering, where speed takes priority over operational discipline.

Laundering behaviour and off-chain indicators

Elliptic describes two behavioural patterns. First, the stolen funds were quickly swapped out of stablecoins and other non-native tokens into each blockchain's native asset, which is consistent with how DPRK-linked laundering has been observed before. Second, the exception also fits: assets stolen on Arbitrum were rapidly bridged to Ethereum. Elliptic suggests this may reflect lessons from the KelpDAO laundering case, in which the Arbitrum Security Council acted to freeze 30,766 ETH. Elliptic adds that off-chain indicators are consistent with those seen in earlier DPRK-attributed operations.

The wider 2026 picture

Elliptic says the Bitget theft would be the largest single theft attributed to North Korea in 2026, a year in which it has already tracked more than 51 DPRK-linked incidents. The same research also references a Drift Protocol exploit of $286 million with suspected North Korean involvement. The table below lists the earlier major attacks on centralized exchanges and bridges that Elliptic says were ultimately attributed to DPRK-linked actors.

Attribution is a moving target and should be treated with care. Bitget's own CEO called the actor a "likely" North Korean group, and the technical evidence behind that call is not yet public. Finance and compliance teams should record attribution as reported by named sources, not as an established legal finding.

What it means for accounting teams and CFOs

Exposure mapping comes first

The first question after any exchange incident is simple: how much did we have there, in which assets, and on which date? Teams that keep balances across several venues often answer that from memory or from a spreadsheet assembled under pressure. Good digital asset accounting software should let you pull a dated position by venue, wallet and asset in minutes, reconciled to exchange statements and on-chain data. If your records are only updated at month end, you can't reliably say what was at risk on 24 September.

For this incident, the relevant slice of the books is any balance held at Bitget, particularly in the assets named in the exploit. Even where Bitget says users are made whole, finance teams still need to document the position, the withdrawal suspension period, and any communication received from the exchange.

Loss events, recoveries and the user protection fund

Bitget says the user protection fund covers the loss fully. For customers, that statement does not by itself resolve the accounting. Whether any loss, impairment or contingent recovery needs to be recognised depends on the entity's reporting framework, the terms of its agreement with the exchange, how the assets are classified, and whether the entity's own balances were actually affected. Those are judgement calls for the responsible accountant and auditor, and nothing in the source dictates a specific treatment.

What the source does support is a discipline around evidence. Teams should preserve the exchange's public statements, any customer notices, withdrawal-suspension records and balance snapshots. If a recovery or compensation arrives later, your crypto bookkeeping software should let you tie it back to the original position rather than booking it as an unexplained inflow.

Withdrawal suspensions and liquidity

Bitget suspended withdrawals as a precaution. For a treasury team, a suspension means assets that normally count as readily available may not be accessible for a period. Even a short freeze can affect cash-flow forecasts, covenant calculations or settlement obligations that depend on those balances. Flag affected balances separately in management reporting while a suspension is active, and keep a note of when access is restored.

Tax implications for firms and their clients

The source is an on-chain analytics report, not tax guidance, so it says nothing about how any jurisdiction treats stolen or inaccessible crypto. The tax position depends on local rules, on who bore the loss, and on whether a compensation scheme made the holder whole. Firms advising clients with Bitget balances should avoid assuming a deductible loss. If the user protection fund covers the loss, there may be no loss to claim at all. The prudent step is to document facts now and take jurisdiction-specific advice before deciding anything for a return.

Compliance and AML angles

Screening against flagged addresses

Elliptic says it updated its datasets with the addresses tied to this incident, so users of its tools will see the newly attributed addresses in their screening, monitoring and investigation workflows. The wider lesson for regulated firms and their auditors: stolen funds move fast, are swapped into native assets, and are bridged across chains. Any inflow that can be traced back to flagged addresses is a risk, even if it reaches you several hops later.

Accounting firms that handle client wallets, and corporates that accept crypto payments, should confirm that incoming transfers are screened against current attribution data and that the screening results are retained as audit evidence. Where your accounting platform imports on-chain transactions, check that you can mark and quarantine suspicious receipts without breaking the reconciliation.

Sanctions and reporting duties

The source doesn't set out specific legal duties arising from this incident, so none are asserted here. What can be said is that proceeds linked to state-backed actors are a standing concern for compliance officers. Whether an incident triggers a suspicious activity report or similar filing is a decision for the firm's money laundering reporting function under local law. Your accounting records should make it easy to answer the regulator's likely first questions: which counterparties, which addresses, which dates.

A practical checklist for the next 30 days

For accounting firms and auditors

Ask clients to list every exchange where they held balances on 24 September 2026, with asset-level detail. Request the exchange's notices and statements. Confirm whether the client's own funds were affected or only the exchange's. Consider whether subsequent-event or going-concern disclosures are relevant for clients with material exposure, and document the reasoning either way. Where audit evidence of existence relies on exchange statements, assess whether the incident changes how much reliance you can place on them.

For CFOs and treasury teams

Review concentration: how much of your digital asset balance sits at any single venue. Check whether your custody agreements describe what happens in a hack and how the user protection fund, insurance or segregation applies. Review how quickly you can move balances to self-custody or to an alternative venue. Confirm that your policy for hot versus cold storage at third parties is written down and approved.

For the systems behind the books

Whatever platform you use, test it against this scenario. Can it produce a dated position by venue and asset? Can it hold a loss or recovery event with supporting documents attached? Can it flag and isolate transactions tied to a flagged address? Can it export a clean audit trail? These are the real selection criteria for crypto accounting software after an incident like this, more than any feature list. Our related coverage, including our earlier breakdown of the Bitget hack and the $1B DPRK threshold, goes further on exposure mapping, and what finance teams should check after the Binance hack covers a comparable review. For a smaller-scale precedent on freezes and recoveries, see how the Mercado Bitcoin freeze affected finance teams. The broader framework sits in our crypto compliance reporting pillar.

What to watch next

Open questions

Several things remain unresolved in the public record. Bitget has not published the technical basis for its attribution. The precise mechanics of the backend compromise are not detailed beyond the forged transaction data description. And while Bitget says the loss is fully covered, how and when any affected customers were made whole is a matter for the exchange's own disclosures.

Why it keeps happening

Elliptic notes that most of the biggest hacks of centralized exchanges and bridges in recent years were ultimately attributed to DPRK-linked actors. For finance leaders, the takeaway isn't that any single venue is unsafe, it's that third-party platform risk is a recurring, state-scale threat that belongs in your risk register with a named owner. Treat it as a standing line item in reporting, supported by software that records positions precisely and by procedures that your auditors can follow.

FAQ

How much was stolen in the Bitget attack?

Elliptic reports more than $350 million in unauthorized transfers from Bitget's hot and warm wallets, spread across assets including ETH, XRP, BNB, AVAX, USDT and USDC on several networks. Bitget says the loss is fully covered by its user protection fund.

Is North Korea confirmed as responsible?

Not conclusively. Bitget's CEO said the attack matches techniques used by North Korea-linked groups and called the actor a likely North Korean group. Elliptic links the stolen funds to addresses used in earlier DPRK-attributed laundering, but the exchange hasn't published its technical basis for attribution.

What should crypto accounting software do after an exchange hack?

It should show a dated position by venue, wallet and asset, support attaching evidence to loss or recovery events, let you flag transactions linked to risky addresses, and export a clean audit trail. Those capabilities let a team answer an auditor or regulator quickly.

Can clients claim a tax loss on Bitget balances?

The source doesn't address tax treatment, and it varies by jurisdiction. If a protection fund covers the loss, there may be no loss to claim. Document the facts now and get local tax advice before deciding anything for a return.

Why does laundering behaviour matter to finance teams?

Stolen funds are swapped into native assets and bridged across chains within hours. Receipts that trace back to flagged addresses can create compliance risk even several hops later, so screening results should be kept as part of your audit evidence.

Source: Elliptic