Hackers Stole $352 Million From Crypto Exchange Bitget and North Korea Is the Top Suspect

Your Crypto Balance Isn't in a Vault

You log into your exchange, see your balance, and assume your money is sitting there safely. It isn't. Not really. What you're looking at is a number in a database, backed by funds that live in something called a hot wallet, a software-controlled account connected to the internet at all times. On September 24, 2026, at 18:31 UTC, attackers walked into Bitget's hot wallets and moved $351.6 million out the door before anyone could stop them.

Bitget's CEO Gracy Chen confirmed the breach publicly. Withdrawals were frozen immediately for all users. As of the time of writing, the full scope was still being assessed, though the company said cold wallets and its $464 million user protection fund were unaffected.

North Korea is the leading suspect. Bitget's own on-chain analysis and IP behavior patterns point to a state-linked North Korean hacking group. This is already the largest single crypto exchange hack of 2026.

What Is a Hot Wallet, and Why Does It Keep Getting Hit?

A hot wallet is any crypto wallet that stays connected to the internet. Exchanges use them because they need liquidity on hand to process withdrawals instantly. You request a withdrawal at 2am, the hot wallet pays it out immediately. That convenience has a price.

Being online 24 hours a day, every day, means constant exposure to probing, phishing, social engineering, and zero-day exploits. State-sponsored attackers, particularly North Korea's Lazarus Group and its offshoots, have turned crypto exchange hacking into a funding mechanism for a national government. They are not opportunistic teenagers. They are professional teams running months-long operations against specific targets.

Hot wallets are a structural vulnerability. Every exchange that holds user funds in internet-connected accounts carries this risk. There is no patch that makes a permanently-online target permanently safe.

The Numbers

$351.6 million stolen in a single unauthorized transfer event. Assets taken included Ether, XRP, BNB, AVAX, USDT, and USDC, a spread across major coins and stablecoins, which suggests the attackers either had broad access or moved fast across multiple wallet types.

Bitget's claimed protection fund sits above $464 million, which is larger than the amount stolen. That is better than many exchange breach stories. But "the fund is unaffected" and "users will be made whole" are two different statements. Watch that gap carefully over the coming days.

This is the largest single crypto exchange hack of 2026 so far. And 2026 is not over.

What Should You Actually Do Right Now?

1. Move anything you aren't actively trading to cold storage. A hardware wallet, a physical device that signs transactions offline, cannot be hacked remotely. If your crypto is sitting on an exchange because it's easier, you are accepting the exchange's security posture as your own. For amounts above what you'd leave in a checking account, that is not a reasonable trade.

2. Test your withdrawal process before you need it. A lot of people discover that their exchange requires identity re-verification, a 24-hour delay, or a customer service queue when they try to withdraw under pressure. Do a small test withdrawal right now. Learn the friction while the stakes are low.

3. Enable the strongest 2FA your exchange offers, not SMS. Text message 2FA can be bypassed through SIM-swapping attacks. Use an authenticator app (Google Authenticator, Authy, or a hardware key like a YubiKey). This does not protect against an exchange-side breach, but it closes the most common account takeover path against you personally.

4. Watch for Bitget communications and do not trust anything that isn't from the official domain. Exchange hacks generate phishing waves within hours. Attackers register lookalike domains and send "urgent security" emails asking you to verify your wallet or move funds. Do not click links in emails. Navigate directly. If Bitget contacts you, confirm the sender domain character by character.

5. Check whether your exchange publishes proof of reserves. Reputable exchanges publish cryptographic proof that they hold the assets they claim. If yours does not, you have no independent way to verify that the protection fund or cold wallet claims are real. That is a due-diligence item, not a conspiracy theory.

6. If you have significant holdings at any exchange, consider distributing them. No single exchange should be a single point of failure for a meaningful portion of your net worth. Spreading across two or three reduces your exposure to any one breach.

The Systemic Truth Behind Every Exchange Hack

Here is what keeps happening, and why it will keep happening: exchanges compete on user experience. The smoothest, fastest, most seamless experience requires hot wallets, instant liquidity, and minimal friction. Security adds friction. So security loses in the product roadmap, right up until the moment it catastrophically doesn't.

North Korean state actors are not going away. Blockchain analytics firm Chainalysis estimated that North Korea stole over $1 billion in crypto in 2023 alone. These funds reportedly support weapons programs. The attackers are funded, patient, and focused on exactly the infrastructure gap that makes exchanges convenient: the always-online wallet.

You cannot fix any of this by choosing the right exchange. The vulnerability is structural, not brand-specific. What you can fix is how much of your exposure is sitting in a hot wallet on someone else's server versus in cold storage under your control.

Do this now:

• Move long-term holdings off exchanges and onto a hardware wallet
• Run one test withdrawal from your primary exchange this week
• Switch from SMS 2FA to an authenticator app on every crypto account
• Bookmark your exchange's official domain and never log in through an email link
• Look up whether your exchange publishes proof of reserves

Sources

• finance.yahoo.com
• insurancejournal.com