Bitget crypto exchange has been hacked for a whopping price of $351M. The hacker has swapped most of the funds on EVM chains for 67,982. On-chain monitoring shows that approximately $180 million to $183 million in assets were transferred out from multiple Bitget-tagged addresses, involving assets such as ETH, BNB, AVAX, USDT0, USDC, USDT, and XAUT.
The funds were first aggregated to one primary address and then dispersed to at least 6 addresses. Among them, a newly created address used 19.67 million USDT0 from Bitget’s hot wallet to purchase 7,111 ETH via UniswapX and 1inch Fusion within about 6 minutes, with some transaction prices about 5% higher than the spot market.
Bitget CEO Gracy Chen has held a public live stream regarding the incident, but as of now, the official has not released a written version of any new investigation findings.
We are starting to believe Tornado Cash is run by North Koreans. This has been confirmed by the Bitget CEO Gracie Chen which said on her X post that the team identified IP addresses whose VPN usage patterns matched those associated with a specific DPRK-linked group.
Gracy has also asked Thorchain developers to refuse service to the hacked addresses. This is a weird request since no-one can stop a blockchain. While USDC and UDST funds can be frozen by the issuers, the blockchain and native token of the chain cannot be stopped or refuse service.
Our attacker addresses are publicly listed and actively tracked. We are formally asking @THORChain to refuse service to these addresses. Decentralization is a design principle, not a shield for facilitating known stolen funds.
The industry is watching. https://t.co/rOzV9kpu0F— Gracy Chen @Bitget (@GracyBitget) September 26, 2026
Here is the list of exchanges and amount of crypto funds stolen by the North Korean hackers so far.
- Bybit: $1.5B
- Drift: $285M
- Bitget: $350M
- WazirX: $235M
- KelpDAO: $292M
- Ronin Bridge: $625M
- DMM Bitcoin: $308M