Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

Bitget hacking losses rise to $387 million: An analysis of the incident and North Korea suspicion

2026-09-26 03:38:41

Bookmark

Bitget suffered the largest cryptocurrency hack attack this year, losing approximately US$387.5 million

Yesterday, Bitget suffered approximately US$387.5 million in cryptocurrency theft, which is considered the largest cryptocurrency hack so far this year. Although it has not yet been confirmed, it is widely suspected that North Korea is behind the scenes, and Bitget said law enforcement agencies are investigating this.

Incident history and scale of losses

According to Bitget security system, at 18:31 UTC on September 24, some of its hot money packages were transferred without authorization. In about an hour, on-chain investigators had counted that approximately $183 million worth of stablecoins, Ethereum and other crypto assets had flowed out of wallets marked as exchanges.

Hours later, when Bitget publicly confirmed that it had been hacked, the total loss had increased to US$351.6 million. Bitget, one of the industry's leading crypto exchanges, today updated this loss figure to $387.5 million.

Analysis of attack methods: Forge rather than steal

Bitget CEO Gracy Chen explained the incident in detail through live broadcasts and a series of posts on the X platform. She pointed out: "The attacker did not forge the user's withdrawal request, nor did he obtain the private key of our cold wallet or any hot wallet or warm wallet." Instead, the attacker hacked into the back-end system inside Bitget's wallet infrastructure and used the system to tamper with transaction data, deceiving the exchange's own authorization process into approving seemingly normal payment instructions.

用更通俗的话来说，攻击者并没有偷走金库的密码，而是伪造了足以让系统不加质疑便予以盖章的文件——这相当于在银行柜员只检查单据而不核实身份的情况下，成功递送了一张假的提款单。

链上追踪与资产流向

在Bitget正式确认之前，区块链侦探们已经掌握了一些线索。匿名研究员DCF GOD发现了一个新创建的钱包，该钱包在六分钟内花费1967万美元购买USDT0（Tether美元挂钩稳定币的跨链版本），以高于市场价约5%的价格通过去中心化交易所UniswapX和1inch Fusion购入了7,111枚ETH。

随后，更多被标记为Bitget所属的钱包开始运作，将资产转移至攻击者控制的地址，涉及至少五个不同的区块链。此次被盗资产中最大的一笔约为1.03亿枚XRP，价值约1.57亿美元。

用户资金保障与运营状况

Chen表示，资金外流目前已停止，不再可能发生未经授权的转账。Bitget的用户保护基金持有超过4.64亿美元的资金，将全额覆盖此次损失。这意味着尽管资金本身已丢失，但客户账户余额保持不变。在整个事件中，充值和交易功能保持正常运行，仅出于预防目的暂停了提现服务。

鉴于行业内黑客攻击频发，Bitget早在多年前就建立了这笔保护基金。回顾2023年，该保护基金规模为3亿美元，专门用于应对黑客攻击和盗窃事件，以确保用户不会承担损失。

嫌疑指向朝鲜黑客组织

关于此次攻击的背后主使，Chen谨慎地将矛头指向平壤。“我们识别出一些IP地址与某个特定朝鲜团体使用的VPN选择相匹配，”她表示，“这种模式看起来非常像朝鲜团队之前的所作所为。”她还提到，链上签名与朝鲜国家关联的黑客组织所使用的技术相符，同时强调攻击者的身份尚未确认，且未公开任何技术证据。

Chen透露，她本人此前也曾成为同一团体的目标，在Bitget之外的个人钱包中损失了约8万美元。

朝鲜的Lazarus Group（也被追踪代号为TraderTraitor）已被指责参与了行业内多起重大劫案，包括2025年2月Bybit遭窃的14亿美元黑客攻击案，该案在几周后由美国联邦调查局（FBI）确认为朝鲜所为。区块链分析公司Chainalysis数据显示，该国在2025年的作案金额已超过20亿美元。

后续处理与透明度承诺

Bitget承诺，在其技术团队完成系统修复后，将发布完整的事故报告，包括根本原因分析。提现服务将继续暂停直至明日，届时交易所将公布相关计划，供有需求的用户参考。

Disclaimer:

All content published on this website, including hyperlinks, related applications, forums, blogs, and other media accounts, originates from third-party platforms and their users. CoinMarketInsight makes no representations or warranties of any kind regarding the website or its content. All blockchain-related data and materials are provided for informational and research purposes only and do not constitute financial, legal, or investment advice. Users and third parties are solely responsible for the content they publish. CoinMarketInsight shall not be liable for any losses arising from the use of this website. You should exercise caution and conduct your own independent research, review, analysis, and verification before making any decisions.

Read Full Article

0.00% 0.00%

Bullish

Bearish

Hot Coins