Another major hack has rattled the cryptocurrency world. On Thursday night, crypto exchange Bitget suffered a security breach that drained more than $387 million from the platform. The attack stands as the largest cryptocurrency hack of the year to date.
During a three-hour livestream on X, CEO Gracy Chen said Bitget suspects North Korean attackers exploited a backend system used to process wallet transactions, making fraudulent withdrawals appear legitimate. She said the attackers did not steal private keys, the secret digital credentials used to move crypto, but instead tricked Bitget’s internal approval system into authorizing the transfers.
Bitget said it has fixed the vulnerability and paused withdrawals while it continues to review the platform’s security. The revised loss estimate reflects additional transactions identified on networks including the privacy-focused Zcash blockchain and TRON, which is widely used for stablecoin transfers.
BGB, Bitget’s native token, dropped almost 7% to $1.93. It has since recovered slightly and was trading at $1.97.
Chen said the unauthorized transfers were limited to Bitget’s hot and warm wallets, or company-controlled pools of crypto used to process customer trades and withdrawals. Bitget Wallet, a separate self-custodial product in which users, rather than the exchange, control their own crypto, was not affected.
North Korea has become one of the crypto industry’s most prolific hacking threats. North Korean-linked hackers stole a record $2 billion in cryptocurrency in 2025, according to blockchain analytics firm Chainalysis. The country is widely believed to use crypto theft to generate hard currency amid international sanctions that restrict access to conventional banking and foreign investment. Chainalysis said the groups increasingly target exchanges and other large crypto firms by placing IT workers inside companies, posing as recruiters to steal credentials and approaching executives with fake investor pitches.
Since the breach, Bitget announced a partnership with third-party experts Mandiant and SlowMist to investigate the incident. The exchange also launched a recovery-bounty program offering rewards of up to 5% for funds successfully frozen or recovered, and released a real-time tracking dashboard intended to help outside researchers and other platforms identify the attacker’s wallets.
Bitget said its user protection fund, a reserve intended to compensate customers for losses from security incidents, holds more than $464 million, enough to cover the current loss if the stolen funds cannot be recovered.
The hack is the latest in a series of breaches to hit the crypto sector over the past three months. Earlier this month, Liquid Network, a secondary blockchain designed to facilitate Bitcoin transactions, suffered a $319 million security breach. In late July, Coldcard, a hardware wallet, was hit in a separate attack that drained about $116 million in Bitcoin. That incident raised particular alarm because Coldcard devices are designed to keep users’ Bitcoin keys offline, one of the methods widely considered safest for storing cryptocurrency.
