North Korea-linked hackers push 2026 crypto thefts above $1bn after Bitget hack

Crime Diary, International

SEOUL, South Korea (NPA) — Suspected North Korean hackers have pushed cryptocurrency thefts linked to the country above $1 billion in 2026 following the $387.5 million security breach at crypto exchange Bitget.

Bitget said attackers on September 24 compromised a backend system connected to its wallet infrastructure and manipulated transaction data to trigger unauthorised transfer approvals from hot and warm wallets.

The exchange initially estimated the loss at $351.6 million but later revised the figure to approximately $387.5 million after accounting for additional assets affected on the TRON and Zcash networks. Bitget said its cold wallets and customer balances were not affected.

Advertisement

Bitget said its User Protection Fund, which holds more than $464 million, would cover the loss, while security teams work to restore withdrawals and trace the stolen assets.

The attack is the largest cryptocurrency theft reported so far in 2026, according to TRM Labs.

Bitget CEO Gracy Chen has said North Korean involvement was highly likely, citing similarities with techniques and infrastructure associated with previous North Korea-linked attacks. TRM Labs, however, said it had not definitively attributed the Bitget theft to North Korea, although on-chain links point towards a laundering network previously associated with North Korean operations.

If the Bitget theft is ultimately attributed to North Korea, the country’s crypto thefts in 2026 would exceed $1 billion. TRM had already attributed about $643 million in crypto thefts to North Korea-linked activity during the first half of the year.

North Korea-linked groups were also associated with the $1.46 billion Bybit theft in February 2025, which TRM described as the largest single cryptocurrency theft attributed to the country.

The Bitget incident has renewed concerns over the security of cryptocurrency exchanges, particularly the backend systems and operational infrastructure used to authorise transactions.