Loading story…
Cryptocurrency exchange Bitget confirmed that attackers stole approximately $351.6 million after gaining unauthorized access to part of its wallet infrastructure. The exchange detected unauthorized hot-wallet transfers at 18:31 UTC on September 24 and suspended withdrawals across its platform while it investigated with law enforcement and blockchain-security firms. Bitget CEO Gracy Chen said the incident was a direct breach of company systems or servers and said the exchange suspects North Korea-linked Lazarus Group, although it has not released technical evidence supporting the attribution.
On-chain analysts initially observed roughly $165 million in ETH, stablecoins, and Tether Gold moving from Bitget-labeled wallets to a single externally owned address across Ethereum, Arbitrum, Optimism, and Base; the recipient later forwarded 19.67 million USDT0 received on Arbitrum. Bitget said deposits and trading remain available, customer balances are accurate, and its cold wallets and user private keys were not affected. It stated that its User Protection Fund, valued above $464 million, can cover the loss and pledged to publish a full incident report within 24 hours.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Bitget's public API first showed some ETH withdrawals disabled and later marked none of its 4,930 returned asset-network entries as withdrawable, while deposits were largely enabled and ETH/USDT trading remained online. Bitget later stated it had suspended withdrawals after detecting unauthorized transfers from several hot wallets.
Wallets labeled as Bitget sent approximately $165 million in ETH, stablecoins, and Tether Gold to externally owned address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee across Ethereum, Arbitrum, Optimism, and Base. The observed transfers occurred between about 2:59 p.m. and 4:09 p.m. ET, and some assets were subsequently forwarded onward.
Bitget flagged the receiving addresses and contacted law enforcement and blockchain-security companies while investigating the intrusion vector and how transfers were authorized. It said cold wallets and user private keys were not compromised, customer balances remained accurate, and withdrawals would return after a security review.
Bitget confirmed that attackers obtained unauthorized access to part of its wallet infrastructure and stole approximately $351.6 million, affecting a limited number of hot wallets and part of its warm-wallet layer. CEO Gracy Chen described it as a direct breach of Bitget systems or servers and said the exchange suspected North Korea-linked Lazarus Group, though no supporting technical evidence had been published.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
The February 2025 theft of approximately **$1.5 billion** in cryptocurrency from Bybit was attributed to North Korean threat actors, making it one of the largest known cryptocurrency heists. Attackers manipulated a transaction involving Bybit's Ethereum cold wallet, transferring assets to wallets under their control before rapidly moving and laundering the funds across multiple services. Open-source intelligence (OSINT) analysis linked infrastructure and operational artifacts associated with the theft to North Korean activity, consistent with tradecraft historically associated with the Lazarus Group and related DPRK-backed cryptocurrency theft operations. The incident underscores the continuing risk to exchanges and wallet operators from targeted compromise of transaction-signing workflows, trusted third-party infrastructure, and personnel involved in high-value asset transfers.
Sep 9, 2026
**Bitrefill** said attackers linked to North Korea's **Lazarus Group** breached the cryptocurrency gift card platform on March 1 by first compromising an employee laptop, stealing a legacy credential, and using it to access a snapshot containing production secrets. The intrusion expanded into broader infrastructure, including parts of the database, production keys, and cryptocurrency wallets, and was detected after the company observed suspicious purchasing patterns indicating abuse of its gift card inventory and supplier channels. The company said the attackers drained funds from some hot wallets and accessed about **18,500 purchase records** containing email addresses, crypto payment addresses, IP addresses, and related metadata; roughly 1,000 records also included encrypted usernames. Bitrefill attributed the incident using a combination of **malware analysis, TTPs, IP and email overlaps, and blockchain tracing**, notified affected users, restored operations after taking systems offline, and said it would absorb losses from operational capital, though it did not disclose the total amount stolen.
Jun 29, 2026