Hackers Stole $350 Million From a Crypto Exchange. Here's What Happened
Suspected North Korean hackers stole about $351.6 million from crypto exchange Bitget, the largest known crypto theft of 2026 so far. The theft was reported on Sept. 25, 2026. TechCrunch
The money was taken from hot wallets. Those are accounts kept online to handle daily trading, like cash in a store register.
Bitget paused crypto withdrawals after it found the breach.
Bitget said the hackers did not steal its private keys. A private key is like the password that controls crypto funds. Instead, hackers broke into the wallet software behind the scenes and fed it false transaction data to get approval. CoinDesk The passwords stayed safe. The approval check failed.
That detail matters for people who run exchanges. A stolen password means you must replace locks and review storage. A tricked approval system means you must fix how transactions are checked and confirmed.
Bitget said it holds $464 million in its user protection fund, an insurance pool to cover the loss. That amount would cover the theft in full if used directly. The company has given other values before. It said the fund averaged $580 million under its UEX Security Standard system, and reached $716 million in June 2025. It also reported 163% Proof of Reserves under that system, a public check that it holds enough assets to cover customer deposits.
Bitget CEO Gracy Chen said the attack fit known patterns of North Korean hacker groups. That is still suspicion, not a formal charge or confirmed finding.
The case fits a wider pattern in 2026. According to TRM Labs, North Korea was behind about three-quarters of all stolen crypto value so far this year. In another September heist of $340 million, the hacker returned all but $47 million. Earlier in September, the Bitcoin-based Liquid Network said $320 million was taken in a hack. Bloomberg
Bitget said it faces heavy hostile traffic. Between July 2025 and June 2026, it blocked more than 150 million malicious requests. Earlier in 2026, it listed Immunefi (IMU) on Launchpool and Spot trading. New listings, outside connections, and backend links add places attackers can probe, along with core storage.
The broader context here is where the weak point now sits. Online accounts must stay connected to keep trading fast, so limits can reduce loss but cannot remove risk. When the software that writes up transfers is compromised, correct passwords will still sign wrong transfers.
In my view, the fix is to treat that backend software as untrusted. Exchanges can decode transfers independently, restrict approved addresses, set limits on online balances, and require approvals from separate systems. Full repayment would restore balances, but not trust in the approval process. Over time, these events have usually led to better basic protections, from public reserve checks to clearer fund reports, and this one is likely to push work on ways to verify what a transaction really means.
