Bitget Hack Pushes Suspected DPRK Crypto Theft Past $1 Billion in 2026
A breach at Bitget, one of the world's largest centralised crypto exchanges, has sent suspected North Korean crypto theft above the $1 billion mark in 2026. On 24 September 2026 at approximately 18:31 UTC, Bitget detected unauthorised transfers draining more than $350 million from its hot and warm wallet infrastructure. Blockchain analytics firm Elliptic subsequently identified on-chain links between the stolen funds and laundering addresses used in prior exploits already attributed to the Democratic People's Republic of Korea (DPRK). For accounting firms, auditors, and CFOs who custody or report on digital assets, this incident is not a distant headline. It carries direct implications for counterparty exposure assessment, asset impairment accounting, and sanctions-screening workflows.
What Happened at Bitget
The breach: scope and affected assets
Bitget confirmed that the unauthorised transfers swept across multiple asset classes and networks: ETH, XRP, BNB, AVAX, USDT, and USDC were affected, distributed across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Cold storage was reported to be unaffected. As a precaution, the exchange suspended withdrawals following detection.
Bitget CEO Gracy Chen disclosed an important technical detail: no private key was compromised. Instead, she described attackers who gained access to a backend system within Bitget's wallet infrastructure and used that foothold to forge transaction data. This distinction matters for liability and insurance analysis, as the attack vector was a backend compromise rather than a cryptographic failure.
Coverage of losses
Bitget stated that the full loss is covered by its user protection fund, meaning client balances are expected to be made whole from exchange reserves rather than from recovery of the stolen assets. Whether that assurance holds over time depends on the fund's size relative to the loss, a figure the exchange had not publicly confirmed in full at the time of reporting.
The DPRK Attribution Case
On-chain indicators
Elliptic flagged the associated addresses shortly after the first alerts circulated. Its analysis identified connections between XRP drained from Bitget and ETH from an earlier exploit previously attributed to North Korea. Additional links were found between Bitget funds and addresses involved in laundering activity from other DPRK-attributed hacks, including one from 2025.
Two on-chain patterns are particularly significant. First, stolen stablecoins and non-native tokens were rapidly converted into the native assets of their respective blockchains. This swap-to-native approach is a documented DPRK laundering technique, designed to reduce the usefulness of token-level freezing mechanisms. Second, assets held on Arbitrum were quickly bridged to Ethereum. Elliptic's analysis suggests this may reflect operational lessons drawn from the KelpDAO incident, in which the Arbitrum Security Council intervened to freeze more than 30,000 ETH. By moving funds off Arbitrum quickly, the actors appear to have pre-empted a similar response.
Shared laundering infrastructure: a pattern, not a coincidence
The reuse of laundering infrastructure across separate incidents is itself a recognised DPRK indicator. It reflects an operational style in which speed takes precedence over compartmentalisation. Wallets and bridging routes used in one exploit reappear in subsequent ones, creating traceable threads across incidents that appear, on the surface, to be unrelated.
Gracy Chen stated during an interview that the perpetrator was "probably a North Korean group," though Bitget had not published the full technical basis for that conclusion at the time of reporting. Elliptic's assessment is that off-chain indicators are also consistent with prior DPRK-attributed operations.
The 2026 cumulative picture
Elliptic has tracked more than 51 DPRK-linked incidents in 2026. The Bitget breach, if the attribution is confirmed, would be the single largest individual theft attributed to North Korea in the current year. It is also part of a well-documented multi-year campaign. The list of major centralised exchange and bridge hacks ultimately attributed to DPRK-linked actors includes Ronin Bridge (2022), Atomic Wallet (2023), CoinsPaid (2023), Alphapo (2023), Stake.com (2023), CoinEx (2023), WazirX (2024), and Bybit (2025). The pattern is consistent: large centralised targets, sophisticated backend compromise, rapid cross-chain laundering.
AML and Sanctions Obligations for Compliance Teams
Screening and monitoring updates
Elliptic confirmed it updated its datasets immediately to include addresses linked to the Bitget exploit. Any Virtual Asset Service Provider (VASP) or financial institution using blockchain analytics tooling should verify that their screening lists have been refreshed. For VASPs operating under FATF-aligned AML regimes, screening against updated sanctions and high-risk address lists is not discretionary. A transaction touching a DPRK-linked address, even indirectly through one or two hops, may trigger a Suspicious Activity Report (SAR) or equivalent disclosure obligation depending on jurisdiction.
The reuse of laundering infrastructure across DPRK incidents also means that some of the newly flagged addresses may have historic transaction links to counterparties your clients already onboarded. Retrospective screening of existing wallet relationships is worth considering, particularly for any counterparty that transacted on Bitget around the breach date.
FATF travel rule and counterparty due diligence
For VASPs subject to the FATF Travel Rule, the Bitget incident adds a practical dimension to counterparty due diligence. Transfers that originated from or passed through Bitget's hot wallet addresses in the window around 24 September 2026 UTC may carry tainted provenance. Receiving VASPs should assess whether beneficiary wallets they have processed payments for could be linked to the flagged address clusters.
The scale and cross-jurisdictional scope of the laundering, spanning Ethereum, Arbitrum, XRP Ledger, Avalanche, BSC, Base, and Optimism, means that no single regulator will own the response. Firms operating across multiple jurisdictions should expect parallel inquiries and should be prepared to produce transaction-level records across all affected chains.
For further context on how a major exchange security event translates into compliance and reporting obligations, see our earlier analysis of the accounting and compliance implications of a major exchange hack. On the broader DPRK threat to the crypto sector, our coverage of OFAC sanctions on a DPRK IT worker crypto fraud network provides additional background on how these operations are structured and sanctioned.
Accounting Implications for Firms and CFOs
Impairment and loss recognition
Any entity that held assets on Bitget at the time of the breach faces an immediate accounting question: are those assets recoverable? Under both IFRS and US GAAP, digital assets held on an exchange are generally recognised based on the underlying economic substance of the arrangement. Where recovery depends entirely on an exchange's discretionary protection fund rather than a contractual or legal right, auditors should scrutinise the basis for continuing to carry those balances at full value.
Bitget's assertion that the user protection fund covers the full loss provides some comfort, but accounting teams should document the nature of that fund, including whether it represents a segregated, ring-fenced pool or simply a general exchange reserve. The distinction affects whether a write-down, a receivable, or a contingent asset treatment is most appropriate under the applicable framework.
Disclosure obligations
For listed entities or those subject to continuous disclosure obligations, a material exposure to the Bitget incident may require prompt disclosure. The test is not whether the exchange has promised to make clients whole, but whether the exposure is material and whether there is uncertainty about the outcome. Given that the stolen assets have not been recovered, and DPRK-linked funds historically have an extremely low recovery rate, that uncertainty is real.
Digital asset accounting software and audit trails
This incident reinforces why firms using crypto accounting software need complete, time-stamped transaction records at the wallet and network level, not just exchange-level balances. Hot wallet balances on a centralised exchange are not visible to standard portfolio accounting tools unless the firm also tracks the underlying on-chain addresses. Firms that relied solely on API-level balance feeds from Bitget may face gaps in their audit trail for the period around the breach.
Digital asset accounting software that ingests raw on-chain data, rather than exchange-reported balances, would give auditors a verifiable record of what was in which wallet at what time, independent of what the exchange reports. This architecture becomes essential precisely in scenarios like this one.
Practical Steps for Accounting Firms and CFOs
Immediate priorities
First, identify any client or fund exposure to Bitget as of 24 September 2026. This includes direct custody on the exchange and any counterparty that routed transactions through Bitget in the days around the breach. Second, verify that your blockchain analytics provider has pushed updated DPRK-linked address clusters from the Bitget incident into your screening environment. Third, review whether any wallets in your client base have transacted with addresses in the flagged clusters, even indirectly. A two-hop review is a reasonable starting point; a three-hop review may be required depending on your risk appetite and regulatory guidance.
Fourth, assess whether any balance sheet exposures require disclosure or impairment recognition under the applicable accounting framework. Fifth, document your assessment process, including the date you updated your screening lists and the basis for any conclusion that balances remain recoverable. That documentation will matter if a regulator or auditor later asks whether you acted promptly.
Frequently Asked Questions
How is DPRK attribution established in crypto hacks?
Attribution relies on a combination of on-chain indicators, such as the reuse of specific laundering addresses, bridging routes, and swap patterns, and off-chain intelligence, including operational tradecraft and timing. No single indicator is conclusive, but when multiple patterns match those seen in previously confirmed DPRK operations, the analytical confidence level rises significantly. Official attribution, when it comes, typically follows from law enforcement investigations.
Do firms have SAR obligations if their clients transacted through Bitget near the breach date?
It depends on the jurisdiction and the specific transaction facts. In most FATF-member jurisdictions, a connection to a known or suspected DPRK-linked address, even through an intermediary, can trigger a suspicious transaction reporting obligation. Firms should consult their local AML framework and, where uncertain, file defensively rather than wait for a definitive attribution.
How should the Bitget user protection fund be treated for accounting purposes?
Until the nature and adequacy of the fund is formally confirmed, firms should treat any exposed balances with caution. The appropriate treatment, whether a receivable, a contingent asset, or an impairment, depends on whether there is a contractual right to recovery and whether that right is practically enforceable. Auditors should request documentation of the fund's structure and sufficiency.
Why does the swap-to-native-token technique matter for compliance teams?
Converting stablecoins to native blockchain tokens removes one layer of freezing capability: stablecoin issuers can blacklist specific token addresses, but once funds move into ETH, BNB, or similar assets, that mechanism no longer applies. This makes the laundering harder to interrupt and means compliance teams must track the on-chain trace across multiple asset types rather than relying on issuer-level freezes.
What does shared laundering infrastructure tell us about DPRK's operational approach?
The reuse of wallets and bridging routes across separate incidents suggests that speed of fund movement is prioritised over operational security. It also creates an exploitable pattern for blockchain analytics, since newly stolen funds can be linked to historic DPRK wallets relatively quickly. For compliance teams, it means that address clusters flagged in earlier DPRK incidents remain live indicators worth screening against, even years after the original hack.
Source: Elliptic