Bitget Loses $351.6M in Hot Wallet Breach Tied to North Korea

On September 24, 2026, attackers drained an estimated $351.6 million from Bitget's hot and warm wallets across seven blockchain networks, making it one of the largest exchange hacks on record. Bitget's CEO has described North Korean involvement as "very likely," and blockchain forensics firm TRM Labs has identified multiple on-chain overlaps with wallets previously linked to the TraderTraitor group behind the February 2025 Bybit theft. For accounting firms, auditors, and CFOs with digital asset exposure, this event has immediate implications: it touches custody risk, impairment accounting, AML monitoring obligations, and the reliability of any crypto accounting software workflow that depends on exchange-held balances.

What Happened on September 24, 2026

At 18:31 UTC, Bitget detected unauthorized outflows from its hot and warm wallets. The affected chains were Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, Base, and TRON. Withdrawals were paused shortly after detection.

How the attacker bypassed controls

Bitget's account is technically precise on this point: the attacker did not steal private keys. Instead, they gained access to a backend system connected to Bitget's wallet infrastructure, manipulated the transaction data presented to the authorization process, and caused that process to approve the outgoing transfers. Cold wallets were not touched. The mechanism closely mirrors the Bybit incident of February 2025, where signers were shown spoofed transaction data and approved a cold-wallet transfer they believed was routine. In both cases, the attack surface was the information layer sitting between the authorization decision and the actual signing event, not the cryptographic keys themselves.

Scale across chains

Early on-chain estimates put the loss at $170 to $190 million because initial tracking covered EVM chains only. TRM Labs data subsequently identified approximately $158 million leaving through the XRP Ledger and a further $7 million in TRX, bringing total observed outflows into alignment with Bitget's reported figure of $351.6 million.

Fund Flows: Where the Money Went

TRM Forensics has tagged exploiter addresses under "Bitget Exploiter September 2026," expanding coverage from Ethereum to the XRP Ledger, Bitcoin, and intermediary wallets farther along the fund flow.

Ethereum and EVM chains

On Ethereum, a significant portion of the stolen value passed through a single consolidation address that also received funds from Arbitrum, Avalanche, Base, BNB Chain, and Optimism. A second distribution wallet split its balance into newly created wallets over roughly two hours on the evening of September 24, with most recipients holding approximately 10,000 ETH each. By the morning of September 25, eight wallets held the bulk of the stolen ETH and none had moved funds onward.

XRP Ledger

The XRP followed a parallel structure. Outflows passed through smaller relay accounts and arrived in separate holding wallets carrying round amounts of roughly 20 million XRP each. Most remained stationary as of the morning of September 25.

Conversion and bridging activity

A portion of the proceeds began moving toward Bitcoin before the morning of September 25. Funds on BNB Chain and Ethereum were swapped through THORChain and split across Bitcoin addresses in peel chains. On TRON, stolen TRX was swapped for USDT on SunSwap, moved to Ethereum through USDT0, and then entered the same THORChain route. Smaller amounts passed through Across, Bridgers, Chainflip, and FixedFloat. One documented path shows roughly $9.8 million in BNB leaving Bitget on the evening of September 24, passing through several exploiter wallets, being divided into smaller amounts, and reaching THORChain over the next approximately 13 hours in transfers of a few hundred thousand dollars each, where they were converted to Bitcoin.

Attribution: TraderTraitor and the North Korea Link

Bitget's CEO Gracy Chen cited IP addresses from the exchange's preliminary investigation that she linked to VPN services associated with a North Korean hacking group, calling North Korean involvement "very likely." TRM Labs has not made a definitive attribution as of its September 25 publication, but notes multiple on-chain overlaps with wallets used to launder previous thefts attributed to TraderTraitor, including Bybit and AFX Bridge. TRM states it has not observed the same laundering network working with any other hacking group, which points toward TraderTraitor while leaving open the technical possibility of a different actor.

If the theft is ultimately attributed to North Korea, 2026 would become the second-largest year on record for state-linked crypto theft in TRM's dataset, with over $1 billion stolen across confirmed and probable incidents, trailing only 2025.

Bitget has committed to publishing a full incident report. TRM expects harder technical evidence to emerge in the days following the breach.

Accounting and Reporting Implications for Firms

A breach of this scale at a major exchange forces a set of accounting questions that cannot wait for attribution to be confirmed.

Asset recognition and impairment

Under IFRS and US GAAP, digital assets held at an exchange are typically recognized on the entity's balance sheet as the beneficial owner's asset, regardless of where private keys reside. If your firm, fund, or corporate treasury holds assets on Bitget, the inability to withdraw those assets during a withdrawal pause is a trigger for an impairment assessment. Even if Bitget's User Protection Fund ultimately makes customers whole, the period of uncertainty must be reflected in period-end disclosures. Auditors should request written confirmation from Bitget regarding the status of any client balances, the scope of the User Protection Fund coverage, and the expected timeline for withdrawal resumption.

Custody risk disclosure

This event reinforces the disclosure obligation many preparers have been slow to meet. Where a material portion of an entity's digital assets sits in exchange hot wallets rather than self-custody or qualified custody, that concentration represents a risk factor that should appear in financial statement notes and, for public entities, in risk factor disclosures. The attack mechanism here, spoofing the authorization layer rather than stealing keys, means that standard "private key security" language in custody disclosures may be insufficient. Firms should review whether their disclosures address backend system integrity and transaction data verification.

Practical steps for crypto accounting software workflows

Any crypto accounting software pipeline that ingests transaction data from Bitget via API will need manual intervention. Automated reconciliation should be paused or flagged for the period beginning September 24, 2026, until Bitget confirms the scope of affected wallets and provides authoritative transaction records. Treating the exploiter outflows as ordinary withdrawals in a ledger would produce a material misstatement. The correct treatment is to isolate the affected period, record any confirmed loss as an impairment or write-down, and await the incident report before finalizing balances.

AML Obligations and Compliance Monitoring

For compliance teams at firms that process transactions involving Bitget counterparties, the tagged exploiter addresses published by TRM Labs are now live in blockchain analytics databases. Any inbound transaction that can be traced, even across several hops, to "Bitget Exploiter September 2026" addresses carries an elevated sanctions and AML risk profile.

Cross-chain tracing challenges

The laundering route documented so far illustrates why single-chain monitoring is inadequate. Funds moved from EVM chains to XRP, then through THORChain to Bitcoin, with intermediate stops on TRON and through multiple bridge protocols. A compliance system that monitors only Ethereum or only direct counterparties will not surface these connections. Firms operating under FATF Travel Rule obligations or filing Suspicious Activity Reports should ensure their screening covers multi-hop, cross-chain flows and includes the bridge protocols named in TRM's analysis. Our earlier coverage of crypto bridge hacks and AML red flags sets out the monitoring framework in detail.

The dormancy risk

As of the morning of September 25, most of the stolen ETH and XRP had not moved from holding wallets. The Bybit precedent is instructive: a large share of those proceeds sat stationary for an extended period before moving through mixers and OTC networks. Compliance teams should maintain active screening against tagged addresses even when fund flows appear to have stalled, because inactivity is a known feature of this laundering pattern, not a sign the funds have been abandoned. The pattern of North Korean laundering tradecraft is explored further in our analysis of the Lazarus Group laundering network.

What Firms Should Do Now

The following steps are relevant regardless of whether your firm holds Bitget assets directly or serves clients who do.

Immediate actions

First, identify all client or proprietary balances held on Bitget and document their status as of September 24, 2026. Second, obtain written confirmation from Bitget on balance availability and User Protection Fund coverage. Third, suspend automated reconciliation feeds from Bitget APIs and switch to manual review for the affected period. Fourth, screen all recent inbound transactions against the tagged exploiter addresses now published by TRM Labs. Fifth, review custody risk disclosures in any financial statements due for sign-off in the near term.

Bitget's User Protection Fund, reported at $464 million, appears sufficient to cover the stated loss of $351.6 million, which is a meaningful difference from a pure insolvency scenario. But "sufficient in aggregate" does not mean "immediately available to each user," and the timeline for claims processing is not yet public. Firms should not assume recoveries will arrive within the current reporting period.

Frequently Asked Questions

Did Bitget's private keys get stolen?

According to Bitget, no. The exchange says the attacker compromised a backend system and manipulated transaction data shown to its authorization process, causing approvals to be granted without accessing private keys. Cold wallets were reported as unaffected.

How should client balances on Bitget be treated in financial statements right now?

Balances that cannot be withdrawn should be assessed for impairment as at the date withdrawals were paused. If Bitget's User Protection Fund confirms full coverage and withdrawals resume before the reporting date, the impairment may reverse. Until written confirmation is received, a provision or disclosure of uncertainty is appropriate. Auditors should obtain direct confirmation from Bitget rather than relying on exchange-published statements alone.

Are firms legally required to report suspicious transactions linked to this hack?

In most FATF-member jurisdictions, virtual asset service providers and financial institutions with AML obligations must file a Suspicious Activity Report if they receive funds that can be traced, across any number of hops, to a known exploit. The threshold is reasonable grounds for suspicion, not certainty of connection. The exploiter addresses tagged by TRM Labs are now publicly available and should be integrated into screening systems immediately.

Is North Korean attribution confirmed?

As of TRM Labs' September 25 publication, attribution has not been formally confirmed. Bitget's CEO described North Korean involvement as "very likely" based on the exchange's preliminary investigation. TRM has identified strong on-chain overlaps with previous TraderTraitor laundering infrastructure but has stopped short of a definitive statement, noting that harder technical evidence is expected to emerge in the coming days.

What does this mean for firms evaluating exchange custody versus self-custody or qualified custody?

This breach reinforces the custody risk embedded in exchange hot wallets. Even where private keys are not stolen, a compromised authorization layer can produce the same economic outcome. Firms with material digital asset holdings should review whether concentration in exchange hot wallets is consistent with their investment policy statements, audit committee risk appetite, and any applicable regulatory guidance on digital asset safekeeping. Where qualified custody or self-custody with hardware security modules is available, this event strengthens the case for migration.

Source: TRM Labs