Cryptocurrency exchange Bitget says attackers stole $351.6 million from a limited number of its exchange wallets and it has temporarily halted withdrawals while it investigates. The company said the intruders compromised a critical backend wallet-service system, spoofed transaction data, and triggered the authorization-signing process to move funds across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Cold wallets and the separate Bitget Wallet product were not affected, and Bitget says customer losses will be covered by its protection fund.
Sergiu Gatlan
2026.09.30
98% relevant
This is a direct update on the same Bitget theft event, adding incident-response findings from SlowMist and Mandiant that the attackers first compromised two unnamed third-party security appliances with zero-days, deployed a web shell and malware, moved laterally into the wallet job server, and used a custom withdrawal tool during the September 25 heist.
2026.09.25
98% relevant
This source updates the same Bitget theft with a revised loss total of $387.5 million, says additional Zcash and TRON assets were affected, reports Bitget's attribution to North Korea, and adds Bitget's statement that a wallet-service backend system was breached to forge transfer information without private key leakage.
2026.09.25
97% relevant
This source updates the same Bitget theft with a higher loss estimate of $387.5 million, adds that withdrawals were suspended, says attackers breached a backend wallet-services system, and notes Bitget's public attribution to North Korea/Lazarus along with fund-freezing and bounty efforts.
Eduard Kovacs
2026.09.25
97% relevant
This article appears to cover the same Bitget theft event and adds that Bitget now says the attack pattern is highly consistent with North Korean actors, that a critical backend wallet system was compromised rather than private keys, and that some attacker-linked wallet addresses have been frozen.
info@thehackernews.com (The Hacker News)
2026.09.25
99% relevant
This appears to be the same underlying event: Bitget attributing the $351.6 million theft to suspected North Korean hackers and adding that the compromise involved its backend systems.
Sergiu Gatlan
2026.09.25
100% relevant
This article establishes a distinct new breach event at Bitget, including the victim, estimated loss amount, suspected actor attribution, affected wallet infrastructure, and immediate operational impact.