North Korea named suspect in $387M crypto hack
A staggering theft of over $387 million has rocked the cryptocurrency exchange world, with analysts pointing fingers at North Korea for what appears to be a highly sophisticated, state-sponsored cyberattack on the exchange Bitget. The incident, which was identified by the company’s CEO as the largest hack of 2026 so far, exposed deep vulnerabilities in the system and highlighted the perilous intersection of global finance and geopolitical conflict.
The breach was not a simple external intrusion; it involved exploiting the exchange’s backend wallet system. Hackers managed to forge transfer approvals, tricking the system into authorizing massive, fraudulent transactions. While Bitget confirmed that the core cold wallets and private keys remained secure and uncompromised, the manipulation of the transaction processing layer allowed the attackers to siphon funds from various hot wallets.
The stolen assets were diverse, encompassing major cryptocurrencies and stablecoins, including Ether, XRP, USDT, USDC, Avalanche, and BNB across several key blockchain networks. The scale of the loss was clarified through multiple audits, ultimately totaling $387.5 million.
The audacity of the perpetrators extended beyond the initial theft. Immediately following the hack, the attackers moved with chilling efficiency, converting the stolen stablecoins and tokenized gold directly into ETH on decentralized exchanges, effectively circumventing attempts to freeze the funds on the blockchain. Native layer-1 assets like XRP, ETH, and BNB were quickly fragmented and distributed across dozens of new wallets, making recovery exponentially more complex.
In response to the crisis, Bitget took immediate action, temporarily freezing user withdrawals while keeping deposits and trading operational. The exchange activated its extensive User Protection Fund, amounting to over $464 million, to manage the financial fallout. Crucially, the company worked swiftly to patch the backend vulnerability and initiated a staggered withdrawal schedule, beginning September 28, to prioritize complete infrastructure security.
This incident is part of a worrying trend plaguing the crypto industry. History shows that many of the largest hacks are linked to state actors, with North Korea consistently emerging at the top of the list of threat groups responsible for massive financial drains. This event serves as a stark reminder that the digital frontier is no longer just about code and crypto—it is increasingly a battleground for global power.
The ongoing vigilance is paramount. As the industry grapples with these high-stakes attacks, recovery efforts are underway, supported by recovery-bounty programs aimed at assisting victims in reclaiming lost assets. The story of this theft is a stark lesson in the fragility of digital security and the very real threat that geopolitical tensions pose to global financial stability.
Credit
