The facts
Crypto exchange Bitget says attackers took about $351.6 million from its hot and warm wallets on Thursday, Sept. 24. Chief executive Gracy Chen said the systems flagged the transfers at 6:31 p.m. GMT. Decrypt reported Friday that the exchange later raised the tally to $387.5 million. Nineteen transfers. Tokens included ether, XRP, BNB, Avalanche, and the stablecoins USDT and USDC, across Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain, Arbitrum, and others. Lookonchain put the XRP piece at about 103 million tokens, roughly $157 million. Cold wallets were not touched. Withdrawals are frozen. Deposits and trading are still on. Bitget says a user-protection fund of about $464 million covers the loss.
Chen says private keys were not stolen. The attackers got into a backend system, faked transfer data, and tripped Bitget's own approval process. She also said investigators found IP addresses using VPNs previously tied to a North Korean group, and that the method is "highly consistent" with those crews. She called it "very likely." She did not name the unit. Law enforcement is looking. Mandiant and SlowMist are on it, The Next Web reported.
Elliptic, the blockchain firm, went further on Friday. It said multiple indicators make a DPRK link "highly likely," including how the coins were moved and overlaps with addresses used to launder earlier thefts it attributes to North Korea, among them the $1.5 billion Bybit exploit in 2025. Elliptic's number for Bitget is "over $350 million," and it says that incident pushes suspected North Korean crypto theft past $1 billion for 2026. That is an analytics judgment, not a Pyongyang confession and not a U.S. indictment.
The context is ugly either way. The Financial Times, citing TRM Labs, said $1.73 billion had already been stolen in 333 crypto incidents this year before Bitget. TechCrunch, also citing TRM, said North Korea is behind about three-quarters of crypto theft value in 2026. Those groups have long been described, including by U.S. agencies in past cases, as a way the state raises cash for the weapons program. This specific job is not yet in that official pile.
Our take
A country that cannot keep the lights on just ran the most profitable IT department on earth, and the evidence is a VPN habit and a trail of coins that looks like the last job.
Bitget left hundreds of millions in wallets that are connected to the internet on purpose, then watched a backend bug sign the withdrawal slips. The keys were fine. The process was the hole. That is not a genius break-in. That is a cashier who will approve a fake ticket if the screen says the ticket is real. The protection fund is big enough to make the customers whole, which is the exchange admitting the loss is a cost of doing business, not an extinction event.
Elliptic's billion-dollar year is the part that should embarrass everyone else. If the attribution holds, Pyongyang has stolen more crypto in nine months than most countries spend on a navy, using laptops and the same laundering addresses as the Bybit job. The regime's export is not coal. It is other people's ether. Bitget is the latest invoice.
