State-sponsored hackers didn’t need to steal any private keys. They just needed to make Bitget’s own authorization system do the work for them. That’s the core detail from what is now the largest single crypto theft of 2026, a $387.5 million breach that security researchers are already pointing toward North Korea.
According to Android Headlines, Bitget CEO Gracy Chen addressed the attack publicly on X, confirming that security teams traced the breach to IP addresses and VPN infrastructure previously associated with Pyongyang’s cyber units. TRM Labs data, cited via TechCrunch, shows North Korean hacking groups are now responsible for nearly three-quarters of all stolen cryptocurrency in 2026. That’s not a fringe threat anymore. That’s a dominant one.
The method matters here. The attackers didn’t go after cold wallets or try to brute-force private keys. Instead, they compromised a backend software system, injected fake transfer data, and manipulated Bitget’s automated authorization checks into approving withdrawals it should have rejected. Once those checks signed off, 19 separate transactions moved funds across Ethereum, XRP Ledger, Avalanche, BNB Chain, Arbitrum, TRON, and Zcash. The breadth of that list tells you this was carefully planned across multiple chains, not a quick smash-and-grab.
Blockchain analytics firms Bubblemaps and MistTrack tracked what happened next. The attackers converted stolen assets into Ether quickly, accepting a steep discount to do it fast. They offloaded $19.67 million in USDT0 at 5% above market price just to keep momentum. After that, funds were routed through Tornado Cash and THORChain, both of which exist specifically to obscure transaction trails. Recovering any of this money is going to be extremely difficult.
There are a few things Bitget wants users to focus on, and they’re not unreasonable. The exchange’s offline cold storage was not compromised at any point. And Bitget says its $464 million User Protection Fund will absorb the full $387.5 million loss, which means customer balances should remain intact. That’s a meaningful commitment, and if it holds, users won’t personally feel the hit. But it doesn’t change the fact that a fundamental part of the platform’s security architecture failed in a way that attackers clearly understood better than Bitget did.
Cybersecurity firms Mandiant and SlowMist are handling the technical investigation. Bybit CEO Ben Zhou also offered access to the LazarusBounty platform to assist with on-chain tracing, a reference to the Lazarus Group, the North Korean state hacking collective that has been tied to billions in crypto theft over the past several years. Deposits and spot trading on Bitget remain active, but withdrawals are paused while engineers patch the backend signing system that failed.
This attack fits a pattern that the crypto industry keeps acknowledging and then struggling to act on. North Korean operatives have become more sophisticated at targeting the operational layer of exchanges rather than the cryptographic layer. Stealing keys is hard. Tricking software into approving bad transactions is, apparently, more achievable. For any exchange still relying on automated authorization systems without rigorous anomaly detection and human review thresholds on large withdrawals, this should be a direct warning. Backend systems are attack surfaces too.