Full Report
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain
Analysis Summary
# Incident Report: Bitget Backend Compromise and Asset Theft
## Executive Summary
On September 24, 2026, the cryptocurrency exchange Bitget suffered a major security breach resulting in the theft of $351.6 million in digital assets. Suspected North Korean threat actors compromised a critical backend system to spoof transaction data and bypass authorization protocols. While hot and warm wallets were impacted, the exchange's cold wallets and self-custodial "Bitget Wallet" remained secure.
## Incident Details
- **Discovery Date:** September 24, 2026, at 18:31 UTC
- **Incident Date:** September 24, 2026
- **Affected Organization:** Bitget
- **Sector:** Financial Services / Cryptocurrency Exchange
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Preceding September 24, 2026 (Investigation ongoing)
- **Vector:** Backend System Compromise
- **Details:** Attackers gained unauthorized access to a critical backend system within the wallet infrastructure.
### Lateral Movement
- **Details:** The attackers navigated to the wallet infrastructure's authorization components, allowing them to interface with the transaction processing engine.
### Data Exfiltration/Impact
- **Details:** Unauthorized transfers were triggered from hot and warm wallets across multiple chains (Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base). Stolen assets included ETH, XRP, BNB, AVAX, USDT, and USDC, totaling $351.6 million.
### Detection & Response
- **Discovery:** Automated security systems identified unauthorized transfers at 18:31 UTC.
- **Response actions:** Bitget immediately suspended withdrawals, initiated a "comprehensive security review," and contacted blockchain foundations to freeze identified hacker addresses.
## Attack Methodology
- **Initial Access:** Compromise of a critical backend system (specific entry point under investigation).
- **Persistence:** Not disclosed, though backend access was maintained long enough to facilitate transfers.
- **Privilege Escalation:** Gained sufficient rights to interact with the wallet authorization process.
- **Defense Evasion:** Spoofed transaction data to make unauthorized transfers appear legitimate to the authorization system.
- **Credential Access:** Likely involved the compromise of internal system credentials or API keys.
- **Discovery:** On-chain analysis and IP behavior patterns.
- **Lateral Movement:** Movement from general backend systems to the specific wallet infrastructure.
- **Collection:** Gathering of assets from various hot and warm wallet addresses.
- **Exfiltration:** Assets transferred to attacker-controlled addresses across multiple blockchain networks.
- **Impact:** Financial theft and temporary suspension of withdrawal services.
## Impact Assessment
- **Financial:** Estimated loss of $351.6 million.
- **Data Breach:** Compromise of backend system data and transaction authorization logs.
- **Operational:** Temporary suspension of customer withdrawals and emergency engagement of third-party incident response firms (Mandiant/SlowMist).
- **Reputational:** High-profile theft linked to suspected North Korean state-sponsored actors (TraderTraitor/Jade Sleet).
## Indicators of Compromise
- **Network indicators:** Attacker IP behavior patterns consistent with known North Korean hacker groups (specific IPs defanged: N/A in report).
- **File indicators:** Not disclosed.
- **Behavioral indicators:** Unauthorized transaction requests triggered via spoofed data within the backend infrastructure.
## Response Actions
- **Containment measures:** Immediate suspension of all platform withdrawals and isolation of the compromised backend system.
- **Eradication steps:** Enlisted Mandiant and SlowMist to conduct a forensic investigation and identify the intrusion root cause.
- **Recovery actions:** Contacted various blockchain foundations (e.g., Ethereum, BSC) to freeze stolen assets at the address level.
## Lessons Learned
- **Architecture Isolation:** The separation of the "Bitget Wallet" (self-custodial) and cold storage from the exchange's hot wallets successfully limited the scope of the loss.
- **Auth Validation:** Relying on backend data for transaction authorization is a single point of failure; spoofed data can bypass these checks if the backend is compromised.
## Recommendations
- **Multi-Party Computation (MPC):** Implement MPC for hot wallet transactions to ensure no single backend compromise can authorize a transfer.
- **Zero Trust Backend:** Apply zero-trust principles to internal backend communications, requiring independent verification for any transaction-related data.
- **Enhanced Monitoring:** Implement real-time anomaly detection for "IP behavior patterns" to catch nation-state activity before exfiltration occurs.