cryptocurrency-platform-riskoperational-disruptionstate-sponsored-espionage

Bitget Confirms $351.6 Million Wallet Infrastructure Breach, Suspects Lazarus Group

Emerging Technology Risk · 43 sources · Updated 1mo ago · First seen Sep 24, 2026

Cryptocurrency exchange Bitget confirmed that attackers stole approximately $351.6 million after gaining unauthorized access to part of its wallet infrastructure. The exchange detected unauthorized hot-wallet transfers at 18:31 UTC on September 24 and suspended withdrawals across its platform while it investigated with law enforcement and blockchain-security firms. Bitget CEO Gracy Chen said the incident was a direct breach of company systems or servers and said the exchange suspects North Korea-linked Lazarus Group, although it has not released technical evidence supporting the attribution.

On-chain analysts initially observed roughly $165 million in ETH, stablecoins, and Tether Gold moving from Bitget-labeled wallets to a single externally owned address across Ethereum, Arbitrum, Optimism, and Base; the recipient later forwarded 19.67 million USDT0 received on Arbitrum. Bitget said deposits and trading remain available, customer balances are accurate, and its cold wallets and user private keys were not affected. It stated that its User Protection Fund, valued above $464 million, can cover the loss and pledged to publish a full incident report within 24 hours.

New surface, new adversariesTrack how attackers are adapting to this technology.

Track this risk

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

30 events · Aug 31, 2026 – Sep 28, 2026

Reported Sep 29, 20261mo ago
Bitget launches public dashboard to track stolen funds
Bitget launched a public dashboard to track movements of funds stolen in the wallet-infrastructure breach. It also asked exchanges, stablecoin issuers, bridges, custodians, and other industry participants to monitor addresses associated with the theft.
Bitget связывает недавнюю атаку с уязвимостью в стороннем защитном продукте - Хакер
Reported Sep 29, 20261mo ago
Bitget characterizes third-party security flaw as zero-day
Bitget said the vulnerability in the unnamed third-party security product used to obtain privileged internal credentials was a zero-day exploited before a vendor fix was available. The exchange said it notified the vendor, while not identifying the product or confirming whether a patch existed.
Bitget: Напаѓач искористил пропуст во безбедносен производ од трета страна за кражба на 388 милиони долари | MKD-CIRT | Национален центар за одговор на компјутерски инциденти
Reported Sep 28, 20261mo ago
ZachXBT maps alleged Bitget launderer aliases and Kelp DAO link
ZachXBT reported that aliases including jack, HELP ME, Melon, Cc, and lolo/Marin were linked through intermediary wallets associated with laundering Bitget theft proceeds. The report also alleged that lolo/Marin had participated in laundering proceeds from the Kelp DAO exploit earlier in 2026 and described a participant's failed XRP transaction.
Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderers Expose Themselves
Reported Sep 28, 20261mo ago
AMLBot traces Bitget theft proceeds into a Wasabi CoinJoin round
AMLBot traced a suspected laundering route from TRX through USDT, USDT0, Ethereum, THORChain, and approximately 4.59 BTC. Roughly four BTC from that route subsequently entered a Wasabi CoinJoin round, adding a documented Bitcoin-mixing method to the attackers' laundering activity.
Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderers Expose Themselves | Cryptika Cybersecurity
Reported Sep 28, 20261mo ago
Bitget cites VPN-linked IPs in North Korea attribution assessment
Bitget CEO Gracy Chen said investigators identified suspicious IP addresses tied to VPN infrastructure previously used by North Korean hacker groups, describing this as an indicator of North Korean state-sponsored involvement. The exchange characterized the attribution as an assessment rather than confirmed proof.
North Korea named as primary suspect in $387 million Bitget crypto hack - investigators identify IP addresses tied to VPN infrastructure previously used by North Korean hacker groups; thieves swapped stablecoins for ETH in minutes to dodge freezes | Tom's Hardware
Sep 28, 20261mo ago
Bitget resumes Bitcoin withdrawals and identifies third-party product flaw
Bitget resumed BTC withdrawals on the Bitcoin and BSC networks at 4 a.m. ET after suspending withdrawals during the breach response. It said a vulnerability in a third-party security product enabled theft of high-level internal credentials used to issue fraudulent withdrawal commands that bypassed risk controls; the company revoked and reissued credentials and disabled the affected vendor functionality.
Bitget Reopens Bitcoin Withdrawals After $387.5 Million Breach | The Defiant
Sep 28, 20261mo ago
ZachXBT-linked post alleges Chinese actors launder Bitget theft proceeds
A Bluesky post linking to ZachXBT alleged that Chinese illicit actors were laundering funds from the Bitget exploit, which it attributed to DPRK-linked attackers. The claim provided no wallet addresses, technical evidence, or details on the laundering activity.
Post by @lazarusholic.bsky.social - Bluesky
Sep 27, 20261mo ago
Attacker-listed address completes THORChain swap after block-request dispute
After THORChain rejected Bitget CEO Gracy Chen's request to deny service to addresses tied to the theft, an address on Bitget's attacker list successfully swapped 9,999 XRP for Bitcoin through THORChain. Midgard recorded the swap and its Bitcoin payout at 3:14 a.m. ET, demonstrating continued use of the protocol for laundering despite Bitget's public flags.
THORChain Pushes Back on Bitget’s Demand to Block Hacker Addresses | The Defiant
Reported Sep 26, 20261mo ago
Bitget announces phased withdrawal-restoration schedule
Bitget announced a phased plan to restore withdrawals after its September 24 security incident, with Bitcoin scheduled first, followed by Ethereum-related networks, USDT networks, and other token, fiat, and P2P services. It said the vulnerability had been remediated, Mandiant and SlowMist were assisting the investigation, and further withdrawal-infrastructure validation was underway.
Bitget to Resume Withdrawals in Phases | Bitget Support Center
Reported Sep 25, 20262mo ago
Binance shares intelligence and assists Bitget fund tracing
Binance co-CEO Richard Teng said Binance shared intelligence with Bitget and helped trace funds stolen in the wallet-services breach. MEXC and Bybit executives also publicly offered assistance to Bitget.
Bitget blames North Korea for $387.5M crypto wallet raid
Reported Sep 25, 20262mo ago
Bitget offers 5% incentives to freeze and recover stolen funds
Bitget launched a recovery bounty program offering cryptocurrency platforms 5% for voluntarily freezing attacker-linked funds and another 5% for recovered assets. The incentives were part of its effort to trace and recover funds stolen in the wallet-services breach.
Crypto CEO accuses North Korea of stealing $387 million from Bitget platform | The Record from Recorded Future News
Reported Sep 25, 20262mo ago
Bitget engages Mandiant and SlowMist for incident investigation
Bitget engaged incident-response firm Mandiant and blockchain-security company SlowMist to assist its investigation into the wallet-infrastructure compromise and unauthorized transfers.
North Korea Suspected in $351 Million Bitget Crypto Heist - SecurityWeek
Reported Sep 25, 20262mo ago
Affected blockchain foundations freeze attacker wallet addresses
After Bitget contacted foundations for affected chains, some foundations confirmed they had frozen wallet addresses associated with the attackers. This was an additional containment action following the theft.
Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
Reported Sep 25, 20262mo ago
Bitget says User Protection Fund will cover theft losses
CEO Gracy Chen said Bitget's User Protection Fund would cover losses from the wallet theft. Bitget valued the fund at more than $464 million.
Bitget Hot Wallet Hacked - Attackers Stole $351.6 Million From Hot Wallets | Cryptika Cybersecurity
Reported Sep 25, 20262mo ago
Bitget probes backend wallet-services and supply-chain compromise
Bitget said preliminary findings point to a possible compromise of a critical backend component supporting wallet services rather than fraudulent customer withdrawal requests. Investigators are examining whether a third-party tool or supply-chain attack enabled forged transfer instructions to reach authorized signing infrastructure; the initial-access vector and persistence mechanism remained unknown.
Bitget Hot Wallet Hacked - Attackers Stole $351.6 Million From Hot Wallets
Reported Sep 25, 20262mo ago
Bitget begins law-enforcement and blockchain-security investigation
Bitget flagged the receiving addresses and contacted law enforcement and blockchain-security companies while investigating the intrusion vector and how transfers were authorized. It said cold wallets and user private keys were not compromised, customer balances remained accurate, and withdrawals would return after a security review.
Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group
Reported Sep 25, 20262mo ago
Bitget confirms $351.6 million theft and suspects Lazarus Group
Bitget confirmed that attackers obtained unauthorized access to part of its wallet infrastructure and stole approximately $351.6 million, affecting a limited number of hot wallets and part of its warm-wallet layer. CEO Gracy Chen described it as a direct breach of Bitget systems or servers and said the exchange suspected North Korea-linked Lazarus Group, though no supporting technical evidence had been published.
Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group
Sep 25, 20262mo ago
TRM links Bitget laundering network to TraderTraitor activity
TRM Labs reported on-chain overlaps between Bitget theft proceeds and wallets used in prior North Korean-linked thefts, including the Bybit and AFX Bridge incidents, and assessed that the laundering network was used by TraderTraitor. TRM said the theft had not been definitively attributed to North Korea; it also observed some proceeds being routed through THORChain into Bitcoin.
Bitget Loses USD 351.6 Million in Hot Wallet Breach in Likely North Korea Attack | TRM Labs
Sep 25, 20262mo ago
Arkham traces 68,300 ETH across eight attacker-linked addresses
Arkham reported in a September 25 morning snapshot that approximately 68,300 ETH was held across eight fresh addresses after attackers allegedly sold stablecoins and tokenized gold for ETH and bridged ETH from Arbitrum, Optimism, and Base to Ethereum.
Bitget Raises Hack Estimate To $387.5 Million As Token Accounting Widens | The Defiant
Sep 25, 20262mo ago
Bitget publicizes fund-tracing and recovery bounty program
A Bluesky post shared Bitget's security-incident update, titled “Bitget Security Latest Incident Update: Fund Tracing and Recovery Bounty Program,” indicating the exchange was tracing affected funds and offering a recovery bounty. No further details on the bounty, recovery progress, or technical incident findings were provided.
Post by @lazarusholic.bsky.social - Bluesky
Sep 25, 20262mo ago
Investigators reconstruct appliance compromise and bespoke Bitget theft tool
Mandiant and SlowMist found that attackers compromised two unnamed third-party security appliances, established persistent access and command-and-control on one appliance, then moved laterally into Bitget's production wallet environment to deploy malicious packages. SlowMist recovered a customized tool tailored to Bitget's withdrawal logic; it began executing at 01:49 a.m. on September 25.
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Sep 25, 20262mo ago
Bitget confirms spoofed transaction data triggered wallet authorization
Bitget disclosed that attackers compromised a critical backend wallet-infrastructure system, spoofed transaction data, and triggered the authorization-signing process to move funds. It said the intrusion method remained under investigation and that no further unauthorized transfers were possible.
Hackers steal $351.6 million in Bitget crypto exchange hack
Sep 24, 20262mo ago
Chainalysis reconstructs 23-transfer initial distribution and XRP-to-Bitcoin laundering
Chainalysis reported that within three hours of the Bitget theft, attackers distributed the approximately $387 million through 23 transfers across Ethereum, XRP, Zcash, and Tron. It traced stolen XRP through a cross-chain liquidity protocol into Bitcoin that was subsequently routed to attacker-controlled Bitcoin addresses, alongside laundering through bridges, mixers, decentralized exchanges, and instant-swap services.
How Chainalysis Used AI to Trace the $387M Bitget Theft
Sep 24, 20262mo ago
Attackers route approximately 6,300 ETH through Tornado Cash
On-chain analysis found that attackers sent about 6,300 ETH, valued at nearly $19 million, through Tornado Cash within hours of the Bitget wallet breach. This represents an additional laundering route beyond the cross-chain transfers and THORChain activity already documented.
Bitget Hack Climbs to $387.5 Million as Exchange Launches Recovery Bounty and Points to North Korea - CySecurity News - Latest Information Security and Hacking Incidents
Sep 24, 20262mo ago
Bitget raises confirmed theft total to $387.5 million
Bitget revised the value of assets transferred to attacker-controlled addresses from approximately $351.6 million to $387.5 million, stating that the prior estimate omitted Zcash and TRON transfers. The exchange said the higher figure did not reflect additional unauthorized transfers and that it had identified and remediated the underlying vulnerability.
Bitget Security Latest Incident Update: Fund Tracing and Recovery Bounty Program | Bitget Support Center
Sep 24, 20262mo ago
Bitget disables withdrawals following suspicious wallet transfers
Bitget's public API first showed some ETH withdrawals disabled and later marked none of its 4,930 returned asset-network entries as withdrawable, while deposits were largely enabled and ETH/USDT trading remained online. Bitget later stated it had suspended withdrawals after detecting unauthorized transfers from several hot wallets.
Bitget Disables Withdrawals For Every Asset After $165 Million Moves To One Address | The Defiant
Sep 24, 20262mo ago
Attacker swaps $19.67 million in USDT0 for 7,111 ETH
A newly created address beginning 0xe410 received about $19.67 million in USDT0 from a Bitget hot wallet and converted it into 7,111 ETH on Arbitrum within six minutes using UniswapX and 1inch Fusion. The swaps reportedly paid roughly 5% above market price to accelerate execution.
Северокорейские хакеры похитили $350 млн у биржи Bitget - Хакер
Sep 24, 20262mo ago
Bitget wallets transfer roughly $165 million to a common address
Wallets labeled as Bitget sent approximately $165 million in ETH, stablecoins, and Tether Gold to externally owned address 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee across Ethereum, Arbitrum, Optimism, and Base. The observed transfers occurred between about 2:59 p.m. and 4:09 p.m. ET, and some assets were subsequently forwarded onward.
Bitget Disables Withdrawals For Every Asset After $165 Million Moves To One Address | The Defiant
Sep 24, 20262mo ago
Attackers conduct two low-value test transfers before Bitget theft
Bitget said attackers used compromised high-level credentials to submit two small fraudulent withdrawal commands at 18:31 UTC on September 24. The transfers remained below risk-control thresholds and generated no alert; larger fraudulent transfers began about 30 minutes later.
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Aug 31, 20262mo ago
SlowMist traces Bitget initial compromise to third-party zero-day
SlowMist traced the earliest logged malicious activity to August 31, when an attacker allegedly exploited a zero-day in an unnamed third-party security product. A hidden script reportedly accessed an environment variable containing a database password and connected to Bitget's database, preceding the September 24 wallet theft.
Rekt - Bitget - Rekt

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Threat actors

3 linked

Lazarus TraderTraitor Bitget Exploiter

Organizations

1 linked

Bitget

Breaches

1 linked

BITGET-2026-09

Observables

6 linked

SHA-1 hash••••••••••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-1 hash••••••••••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-1 hash••••••••••••••••••••••••••••••••••••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Follow how adversaries are adapting to this technology, and where it touches your stack today.

Track This Risk

Source coverage

Sources

43 references tracked. Mallory keeps watching after this page renders.

Chainalysis BlogNews · Oct 1, 2026

How Chainalysis Used AI to Trace the $387M Bitget TheftOpen source ↗

The Hacker NewsNews · Oct 1, 2026

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency TheftOpen source ↗

Lazarusholic BlueskyNews · Oct 1, 2026

Post by @lazarusholic.bsky.social - BlueskyOpen source ↗

Rekt NewsNews · Oct 1, 2026

Rekt - Bitget - RektOpen source ↗

35 additional sources from 24-09-2026 to 30-09-2026

EtherscanNews · Sep 24, 2026

Token Transfer | EtherscanOpen source ↗

UnclassifiedNews · Sep 24, 2026

Base Transactions Information | BaseScanOpen source ↗

BitgetNews · Sep 24, 2026

[SECURITY NOTICE] Bitget exchange hot wallets Incident - September 24, 2026 | Bitget Support CenterOpen source ↗

Github WebNews · Jun 21, 2018

Knowledge-Base/open-report-V2/incident-response/SlowMist Investigation Progress Report - Bitget_en-us.pdf at master · slowmist/Knowledge-Base · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Bitget Confirms $351.6 Million Wallet Infrastructure Breach, Suspects Lazarus Group

Emerging Technology Risk · 43 sources · Updated 1mo ago · First seen Sep 24, 2026

New surface, new adversariesTrack how attackers are adapting to this technology.

Track this risk

Bitget Confirms $351.6 Million Wallet Infrastructure Breach, Suspects Lazarus Group

How this story unfolded

Bitget launches public dashboard to track stolen funds

Bitget characterizes third-party security flaw as zero-day

ZachXBT maps alleged Bitget launderer aliases and Kelp DAO link

AMLBot traces Bitget theft proceeds into a Wasabi CoinJoin round

Bitget cites VPN-linked IPs in North Korea attribution assessment

Bitget resumes Bitcoin withdrawals and identifies third-party product flaw

ZachXBT-linked post alleges Chinese actors launder Bitget theft proceeds

Attacker-listed address completes THORChain swap after block-request dispute

Bitget announces phased withdrawal-restoration schedule

Binance shares intelligence and assists Bitget fund tracing

Bitget offers 5% incentives to freeze and recover stolen funds

Bitget engages Mandiant and SlowMist for incident investigation

Affected blockchain foundations freeze attacker wallet addresses

Bitget says User Protection Fund will cover theft losses

Bitget probes backend wallet-services and supply-chain compromise

Bitget begins law-enforcement and blockchain-security investigation

Bitget confirms $351.6 million theft and suspects Lazarus Group

TRM links Bitget laundering network to TraderTraitor activity

Arkham traces 68,300 ETH across eight attacker-linked addresses

Bitget publicizes fund-tracing and recovery bounty program

Investigators reconstruct appliance compromise and bespoke Bitget theft tool

Bitget confirms spoofed transaction data triggered wallet authorization

Chainalysis reconstructs 23-transfer initial distribution and XRP-to-Bitcoin laundering

Attackers route approximately 6,300 ETH through Tornado Cash

Bitget raises confirmed theft total to $387.5 million

Bitget disables withdrawals following suspicious wallet transfers

Attacker swaps $19.67 million in USDT0 for 7,111 ETH

Bitget wallets transfer roughly $165 million to a common address

Attackers conduct two low-value test transfers before Bitget theft

SlowMist traces Bitget initial compromise to third-party zero-day

Related entities

Threat actors

Organizations

Breaches

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Bybit Loses $1.5 Billion in Ethereum in Record Crypto Heist

ZachXBT Infiltrates Alleged Bybit Laundering Network, Triggers 442,000 USDT Freeze

Ledger–CryptoBilis Theft Losses Near $93 Million as Funds Move to USDD and Tornado Cash

Bitget Confirms $351.6 Million Wallet Infrastructure Breach, Suspects Lazarus Group

How this story unfolded

Bitget launches public dashboard to track stolen funds

Bitget characterizes third-party security flaw as zero-day

ZachXBT maps alleged Bitget launderer aliases and Kelp DAO link

AMLBot traces Bitget theft proceeds into a Wasabi CoinJoin round

Bitget cites VPN-linked IPs in North Korea attribution assessment

Bitget resumes Bitcoin withdrawals and identifies third-party product flaw

ZachXBT-linked post alleges Chinese actors launder Bitget theft proceeds

Attacker-listed address completes THORChain swap after block-request dispute

Bitget announces phased withdrawal-restoration schedule

Binance shares intelligence and assists Bitget fund tracing

Bitget offers 5% incentives to freeze and recover stolen funds

Bitget engages Mandiant and SlowMist for incident investigation

Affected blockchain foundations freeze attacker wallet addresses

Bitget says User Protection Fund will cover theft losses

Bitget probes backend wallet-services and supply-chain compromise

Bitget begins law-enforcement and blockchain-security investigation

Bitget confirms $351.6 million theft and suspects Lazarus Group

TRM links Bitget laundering network to TraderTraitor activity

Arkham traces 68,300 ETH across eight attacker-linked addresses

Bitget publicizes fund-tracing and recovery bounty program

Investigators reconstruct appliance compromise and bespoke Bitget theft tool

Bitget confirms spoofed transaction data triggered wallet authorization

Chainalysis reconstructs 23-transfer initial distribution and XRP-to-Bitcoin laundering

Attackers route approximately 6,300 ETH through Tornado Cash

Bitget raises confirmed theft total to $387.5 million

Bitget disables withdrawals following suspicious wallet transfers

Attacker swaps $19.67 million in USDT0 for 7,111 ETH

Bitget wallets transfer roughly $165 million to a common address

Attackers conduct two low-value test transfers before Bitget theft

SlowMist traces Bitget initial compromise to third-party zero-day

Related entities

Threat actors

Organizations

Breaches

Observables