Crypto platform Bitget suspects North Korea is responsible for $352 million hack

Cnbc · Sep 25, 2026 · 323 words · By Matthew Tan

headphones Listen to the eFinder podcast briefing

Generate a natural audio summary of this story

Daily briefing

What to know about Crypto platform Bitget suspects North Korea is responsible for $352 million hack

Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.

Claims checked 11

Techniques found 0

Topics 0

Coverage spectrum

Coverage gap: Low Left coverage

Left0%

Center100%

Right0%

4 sources compared across this story cluster. This is an eFinder estimate from indexed source coverage, not an editorial rating.

What happened

Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.

Why it matters

Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group.

Common ground

The pattern of the attack also resembled earlier operations attributed to the country, she said in a livestream on X earlier today.

Perspective signals

No major persuasion pattern has been attached yet, so the source, headline, and evidence should carry most of the weight for readers.

Follow-up questions

What concrete event or decision sits underneath the headline: Crypto platform Bitget suspects North Korea is responsible for $352 million hack?
What evidence would most clearly confirm or weaken the claim that the loss is fully covered by its User Protection Fund, which holds more than $464 million?
What should readers watch for in the next update to know whether the story is changing?

open_in_new Read the original article: https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-3…

fact_checkClaims Checked

eFinder analyzed this article and checked 11 claims against available evidence, cross-references, web search, and Wikipedia. Here is what the fact-checking layer found.

check_circle Corroborated 4

info Single Source 3

verified Verified By Reference 2

help Insufficient Evidence 1

schedule Pending 1

verified

Claim 1: “the loss is fully covered by its User Protection Fund, which holds more than $464 million”

VERIFIED BY REFERENCE

The provided evidence includes general Wikipedia entries on AI and the Lazarus Group, but nothing regarding a 'User Protection Fund' of $464 million.

menu_book

wikipedia NEUTRAL — A broad range of public, academic, and political debates regarding the societal effects of artificial intelligence (AI) have intensified particularly in the late 2010s and 2020s, coinciding with an ac…
https://en.wikipedia.org/wiki/Artificial_intelligence_contro…

menu_book

wikipedia NEUTRAL — Bitget is a cryptocurrency exchange founded in 2018. In September 2026, the exchange was hacked, with losses estimated at US$387.5 million.
https://en.wikipedia.org/wiki/Bitget

menu_book

wikipedia NEUTRAL — The Lazarus Group (also known as the Guardians of Peace or Whois Team) is a state-sponsored hacker group made up of unknown members, alleged to be run by the government of North Korea. While not much …
https://en.wikipedia.org/wiki/Lazarus_Group

verified

Claim 2: “investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group”

VERIFIED BY REFERENCE

The provided evidence for this claim consists of irrelevant search results (pornographic sites and general Wikipedia entries on VPNs and censorship) and does not mention IP addresses or VPNs linked to North Korean hackers in the context of the Bitget breach.

menu_book

wikipedia NEUTRAL — Wikipedia has been censored by a number of governments, including, but not limited to, those of Belarus, China, Indonesia, Iran, Iraq, Myanmar, North Korea, Pakistan, Russia, Saudi Arabia, Syria, Turk…
https://en.wikipedia.org/wiki/Censorship_of_Wikipedia

menu_book

wikipedia NEUTRAL — Ipidea is a Chinese company known for having operated a large residential proxy. Google researchers discovered that Ipidea controlled millions of residential Internet connections through consumer devi…
https://en.wikipedia.org/wiki/Ipidea

menu_book

wikipedia NEUTRAL — A virtual private network (VPN) service is a proxy server marketed to help users bypass Internet censorship such as geo-blocking and users who want to protect their communications against user profili…
https://en.wikipedia.org/wiki/VPN_service

+ 3 more evidence sources

check_circle

Claim 3: “Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets”

CORROBORATED

Multiple web search results confirm a hack of Bitget involving approximately $351.6 million. While the Wikipedia entry mentions a different amount ($387.5 million) and date (September 2026), the specific figure of $351.6 million is reported across multiple independent web sources.

menu_book

wikipedia NEUTRAL — Bitget is a cryptocurrency exchange founded in 2018. In September 2026, the exchange was hacked, with losses estimated at US$387.5 million.
https://en.wikipedia.org/wiki/Bitget

menu_book

wikipedia NEUTRAL — The world's busiest airport is Hartsfield–Jackson Atlanta International Airport in metropolitan Atlanta, Georgia, which has been the world's busiest airport every year since 1998 with the exception of…
https://en.wikipedia.org/wiki/List_of_busiest_airports_by_pa…

+ 3 more evidence sources

check_circle

Claim 4: “cold wallets remained secure”

CORROBORATED

Multiple independent sources (SlowMist and a security incident timeline) explicitly state that cold wallets were not compromised.

travel_explore

web search NEUTRAL — Bitget Wallet was not affected by the incident. It is a separate, non-custodial product and operates on infrastructure separate from the exchange wallet systems involved in the security incident.
https://www.bitget.com/academy/bitget-security-incident-what…

travel_explore

web search NEUTRAL — Bitget CEO Gracy Chen admitted that private keys were not compromised, but expressed pessimism about the possibility of recovering the funds.TL;DR: A MEXC user lost $340,000 in 13 minutes through an A…
https://crypto-economy.com/slowmist-ties-bitgets-388m-hack-t…

travel_explore

web search NEUTRAL — She said Bitget’s private keys and cold wallets were not compromised. Bitget is still trying to recover the stolen assets.
https://cointelegraph.com/news/bitget-hack-zero-day-slowmist…

check_circle

Claim 5: “Private key compromise has been ruled out”

CORROBORATED

Multiple sources, including SlowMist and reports on the spoofing attack, explicitly state that private key compromise was ruled out by Bitget.

travel_explore

web search NEUTRAL — Bitget Wallet, formerly known as BitKeep, is a cryptocurrency wallet of Bitget. In October 2022, BitKeep's swap feature was exploited, resulting in losses of about US$1 million. Following a separate D…
https://en.wikipedia.org/wiki/Bitget

travel_explore

web search NEUTRAL — Buy, trade, hold, and earn effortlessly with the Bitget platform.
https://www.bitget.com/login

travel_explore

web search NEUTRAL — Bitget UEX – die weltweit erste Universal Exchange. Traden Sie Kryptowährungen, Aktien, Gold-CFDs, Forex und Rohstoffe in einem einheitlichen Konto. Integrierte GetAgent-KI für 24/7-Trading-Unterstütz…
https://www.bitget.com/de

help

Claim 6: “Bybit following its $1.5 billion hack in February 2025”

INSUFFICIENT EVIDENCE

No evidence was found after searching for a $1.5 billion Bybit hack in February 2025.

check_circle

Claim 7: “the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process”

CORROBORATED

Three independent web sources confirm the specific mechanism of the attack: compromising a backend system, spoofing transaction data, and triggering the authorization process.

travel_explore

web search NEUTRAL — Bitget says attackers didn't steal its private keys. Instead, they compromised a critical backend system inside its wallet infrastructure, spoofed transaction data and triggered the exchange's own aut…
https://www.binance.com/en-IN/square/hashtag/bitgetbreachfor…

travel_explore

web search NEUTRAL — "The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.
https://www.bleepingcomputer.com/news/security/hackers-steal…

travel_explore

web search NEUTRAL — Bitget lost $351.6 million after attackers compromised a wallet backend, spoofed transaction data and triggered the exchange’s authorization process, though the company said its private keys were not …
https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-…

info

Claim 8: “Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally”

SINGLE SOURCE

The evidence provided for this claim consists of general Bitget landing pages and a Wikipedia entry about a 2022 event; there is no mention of current withdrawal suspensions.

travel_explore

web search NEUTRAL — Buy, trade, hold, and earn effortlessly with the Bitget platform.
https://www.bitget.com/login

travel_explore

schedule

Claim 9: “Bybit is updating its LazarusBounty platform to help trace the stolen funds”

PENDING

This claim was extracted as a checkable statement from the article. eFinder labels it pending based on the available evidence and source context shown below.

info

Claim 10: “Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks”

SINGLE SOURCE

The search results provided for this claim are about general supply chain asset management and Microsoft Dynamics 365, not the specific crypto assets stolen in the Bitget breach.

travel_explore

web search NEUTRAL — Jul 27, 2026 · This article provides an overview of assets in Asset Management. An asset is any type of equipment, such as a machine or a machine part, that requires maintenance, service, or repair.
https://learn.microsoft.com/en-us/dynamics365/supply-chain/a…

travel_explore

web search NEUTRAL — Jan 6, 2025 · Learn how to create an asset in Asset Management, including a detailed step-by-step process on creating assets and an outline on general information.
https://learn.microsoft.com/en-us/dynamics365/supply-chain/a…

travel_explore

web search NEUTRAL — Access has a web app called "Asset tracking" that helps you track your inventory of business assets. You can download and create the app (it's free) in about a minute and then customize it to fit your…
https://support.microsoft.com/en-us/access/track-inventory-w…

info

Claim 11: “Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure”

SINGLE SOURCE

The evidence provided for this claim consists of general Bitget homepages and a Wikipedia entry about a 2022 BitKeep exploit, but contains no mention of 19 unauthorized transfers on a Thursday afternoon.

travel_explore

web search NEUTRAL — Buy, trade, hold, and earn effortlessly with the Bitget platform.
https://www.bitget.com/login

travel_explore

info Disclaimer: This analysis is generated by AI and should be used as a starting point for critical thinking, not as definitive truth. Claims are verified against publicly available sources. Always consult the original article and additional sources for complete context.