28th September – Threat Intelligence Report · 2026-09-28
Cryptocurrency exchange Bitget has disclosed the theft of $351.6 million from several hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals. Bitget said cold wallets and most platform assets were unaffected, while suspected North Korean involvement remains under examination.
Bitget exchange hot and warm wallet unauthorized transfers · Sep 25, 2026 (incident 24 September, 2026)
Multiple indicators suggest the over $350 million exploit of Bitget exchange is highly likely to be linked to the Democratic People's Republic of Korea (DPRK).
Bitget exchange theft · published 2026-10-01 (theft September 24, 2026)
On September 24, 2026, DPRK-attributed threat actors stole $387 million from cryptocurrency exchange Bitget.
Bitget hot wallet breach · published 2026-09-25
Bitget's CEO has described North Korean involvement as "very likely," though TRM has not definitively attributed the attack.
Bitget exploit laundering via Zcash Ironwood pool, hack September 24, 2026 · 2026-09-30 (post date)
The alleged DPRK attackers have just begun shielding ~2.7K ZEC ($3.8M) total from the Bitget exploit into the Ironwood pool. ~18.9K ZEC ($28.3M) total was stolen from the Bitget hot wallet on September 24, 2026.
Bitget hack · published 2026-09-28
The pattern of converting assets, including rapid conversions of some assets, IP addresses used, and transfers to wallets linked to past hacks, resulted in this incident being attributed to North Korea's Lazarus Group.
Bitget hack · (page date not captured; incident September 2026)
She also revealed that the attackers' IP addresses matched VPN patterns associated with North Korean hacking groups, suggesting the operation was likely carried out by the DPRK - and, if so, most plausibly by the Lazarus Group
Bitget cryptocurrency exchange · 24/09/2026
Bitget confirms suspected North Korean hackers compromised a critical backend system within its wallet infrastructure to spoof transaction data and trigger unauthorized fund transfers, stealing $351.6 million initially (later revised to roughly $390 million across multiple networks) from hot and warm wallets. [Date Occurred: 24/09/2026; Date Discovered: 24/09/2026]
가상자산 거래소 비트겟, 3억 5160만 달러 탈취 당해…북한 해커 집단 배후 · 2026-09-27
attribution sentence(s): 비트겟 예비 조사, 북한 연계 추정 VPN 주소·공격 패턴 포착 | 이미지 확대보기가상자산 거래소 바이비트(Bybit)가 '라자루스바운티(LazarusBounty)'를 업데이트해 화이트헤커들이 암호화폐의 이동 경로를 추적하는 모습. | 그레이시 첸 비트겟 최고경영자(CEO)는 소셜미디어 X를 통해 조사팀이 과거 북한 해킹 집단이 사용한 가상사설망(VPN)의 인터넷 프로토콜(IP) 주소를 확인했다고 밝혔다.
North Korean cybercriminals linked to $352M heist from crypto exchange Bitget · 2026-09-25
attribution sentence(s): The ultimate resources for professionals working on North Korea | The theft — the largest in 2026 so far — pushes DPRK-linked crypto losses above $1B this year after several major heists | North Korean cybercriminals are likely behind this year’s largest virtual heist so far, which resulted in the theft of $351.6 million from Seychelles-based cryptocurrency exchange Bitget, according to the head of the company.
보안업체들 “비트겟 해킹, 북한 연계” · 2026-10-02
attribution sentence(s): 지난달 암호화폐 거래소 비트겟에서 약 4억 달러가 탈취된 사건과 관련해, 암호화폐 분석업체들이 잇따라 북한 연계 가능성을 매우 높게 평가했다. | 지난달 암호화폐 거래소 비트겟에서 약 4억 달러가 탈취된 사건과 관련해, 암호화폐 분석업체들이 잇따라 북한 연계 가능성을 매우 높게 평가했습니다. | 암호화폐 분석업체 엘립틱이 비트겟 거래소에서 발생한 대규모 자금 탈취 사건의 북한 연계 가능성이 매우 높다고 평가했습니다.