Gracy Chen: North Korea 'Very Likely' Behind $350M Bitget Hack

Bitget CEO Gracy Chen stated that North Korea was "very likely" behind the $350 million theft from the exchange. She added that the attackers broke into a backend system but did not access private keys.

Withdrawals have stayed halted since the September 24 incident. DefiLlama now lists it as the largest crypto hack of 2026 to date.

Chen Ties VPN Trail to North Korean Hackers

Chen discussed the hack during a live Q&A on X after the breach. She pointed to the Democratic People's Republic of Korea (DPRK) as the source.

"But we've identified some IP addresses that match the VPN choices by a certain DPRK group. So we think this is very likely to be attacked by North Korean," she said.

Chen did not name the group. On-chain analyst Specter, however, said the stolen XRP (XRP) was bridged and linked directly to funds from the AFX Trade exploit.

AFX lost around $24 million in July. Specter noted that attack had been attributed to TraderTraitor, a unit tied to Lazarus. LayerZero had linked the KelpDAO bridge exploit to the same unit in April.

Regarding who is behind the hack:

I present to you THE LAZARUS GROUP.

just linked this hack to the AFX hack, which stole $24M in July and was specifically attributed to TraderTraitor.

The stolen XRP from Bitget was bridged and can be directly linked to the funds stolen in the… https://t.co/3CgWFaXF1i

— Specter (@SpecterAnalyst) September 25, 2026

Method Used to Bypass Private Keys in Bitget Hack

Chen said the hackers did not secure private keys for Bitget's hot, warm, or cold wallets, nor did they fabricate withdrawal requests. She offered more detail in a later post.

"The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out," she explained.

She stated the losses are contained and no further unauthorized transfers can occur. A Lookonchain breakdown shows the attackers took nine different assets.

XRP made up the largest portion, with about 102.9 million tokens worth roughly $157.5 million. Bitget's confirmed loss is about double the initially reported $176 million from on-chain data.

The exchange says its User Protection Fund, now above $464 million, will cover the full loss.

BITGET HAS A $464M EMERGENCY FUND FOR HACKS

The exchange holds around 5,500 BTC in its Protection Fund, designed to cover users in case of hacks or stolen assets. Bitget launched the fund in 2022 and previously committed to keeping it above $300M.

At the end of August, it held… https://t.co/RmyH9VeseG

— BeInCrypto (@beincrypto) September 24, 2026

Bitget Hack Becomes Largest Crypto Theft of 2026

DefiLlama data ranks the Bitget theft as the biggest crypto hack of 2026 so far, surpassing Liquid Network's $320 million September incident and Drift's $295 million April breach.

The tracker reports about $2.2 billion lost across 281 incidents this year. Bitget accounts for roughly 16% of that total. September thus becomes the costliest month of 2026, exceeding April's roughly $648 million.

North Korean groups drove most early 2026 losses. TRM Labs found they accounted for 76% of crypto hack losses through April, mainly via the Drift and Kelp attacks. In 2025, Lazarus carried out the $1.5 billion Bybit hack, the year's largest.

Chen has promised a full technical report once investigators confirm how the intrusion happened. That report should show whether forensic evidence supports the North Korea attribution.