Crypto exchange Bitget lost about $351.6 million in unauthorized transfers on Thursday, the largest known crypto heist of 2026. Attackers breached a backend system in the exchange's wallet infrastructure and drained hot wallets across several chains, TechCrunch reported.
The theft spanned ETH, XRP, BNB, AVAX, USDT and USDC, with XRP taking the largest loss on a single chain. No private keys were compromised: the attackers exploited backend approval systems instead, and cold wallets were never touched, according to a threat report on the incident.
Related reading: $18B in bitcoin and ether options expire Friday; SEC faces Sept 27 deadline on options for crypto ETFs.
The North Korea trail
CEO Gracy Chen said the breach was "highly consistent with known patterns of North Korean hacker organizations," citing attack patterns and IP behavior tied to North Korea-related VPNs. But she stopped short of confirmation: the link rests on early findings, and the exact intrusion method is still under investigation, BitcoinEthereumNews reported.
The suspicion fits a grim pattern. Blockchain intelligence firm TRM Labs estimates North Korea is behind around three-quarters of all crypto thefts in 2026, with proceeds funding the regime's weapons programs. "Private key compromise has been ruled out. Loss containment is confirmed. No further unauthorized transfers are possible," Chen added.
Bitget says users are covered
The exchange has suspended crypto withdrawals while it investigates, and says its $464 million user protection fund plus reserves cover the losses in full. Chen explicitly rejected any comparison with FTX, stressing that customer assets remain backed.
Cybersecurity firms Mandiant and SlowMist are assisting, the incident has been reported to authorities, and some attacker-linked wallet addresses have already been frozen by blockchain foundations. A full technical report will follow once the intrusion method is confirmed.
The market shrugged
Remarkably, crypto rallied through the news. The global market cap rose 1.9% to $2.96 trillion, bitcoin held near $84,000 with ETF demand returning, and sentiment stayed in Greed at 71, CoinGabbar reported. Fresh US stablecoin rules and a BlackRock onchain partnership gave bulls bigger things to think about.
That calm is a vote of confidence in Bitget's reserves, but also a reminder: markets forgive hacks fast when users are made whole, and punish them brutally when they are not.
What it means for Malaysian traders
Anyone keeping size on offshore exchanges just got a free stress test. Withdrawal suspensions lock funds without warning, and recovery depends entirely on the exchange's balance sheet. Malaysia's licensed platforms such as Luno operate under Securities Commission rules with segregated client assets, a different safety model from offshore leverage venues.
The oldest rule still applies: coins on an exchange are an IOU. Active traders accept that risk for speed, but long-term holdings belong in self-custody where no backend breach can reach them.
What to watch next
- The technical report: how the backend was breached decides how worried rivals should be
- Attribution: confirmed North Korea link would trigger sanctions machinery
- Frozen funds: watch whether more attacker wallets get blacklisted
- Withdrawals resume: the all-clear moment for Bitget users