What changed.

Bitget's reported breach total rose to $387.5 million to $388 million after it identified roughly $35 million to $36 million more in affected assets from the same incident. The range reflects differences in the reported figures; the supplied record does not settle on a more precise total.

Decrypt reports that the attacker used fake internal transfer requests to drain hot and warm wallets. That account makes the handling of transfer requests a central question for understanding the breach, though the supplied record offers no further detail on the controls involved.

Why it matters.

The larger total changes the reported scale of the incident. The exchange's next operational update also matters: Bitget said it would announce a withdrawal plan by Sept. 26, but the supplied record does not include that plan.

Bitget's CEO said the attack's fingerprints look like North Korea's. That is the exchange's assessment, and the supplied reports do not independently confirm it. A posted bounty may help generate leads, but the record does not show any recovery tied to it.

What to watch

Watch for Bitget's withdrawal plan, a reconciled accounting of affected assets, and independently supported findings from stolen-fund tracing.

Sources and limits

Upstream references and independent checks

Digest dated 2026-09-26 · upstream model sonnet. Direct links are matched to all 4 upstream source IDs.

  1. 1
    North Korean Hackers Linked to $388M Bitget Crypto Exchange Theft: CEODirect upstream source · 9f97dc190475e44c4ee8ce999472c6ec7e5a8b8d
  2. 2
    Bitget clarifies $388M in assets affected by security breachDirect upstream source · 0c476471e5a303f8a92051631e5a14f2284a96ea
  3. 3
    Bitget’s hack just got $36 million bigger, and now there’s a bounty on the stolen cryptoDirect upstream source · 80bd242b8a9b2ffd081926fce373ccc9a2116c51
  4. 4
    Bitget Hack Losses Climb to $387M: Here’s What Happened, and Why North Korea Is a SuspectDirect upstream source · 28ccedcf648c9f5e158f706232fc91596728ae98
Continue reading
  1. 1
  2. 2
  3. 3

This Research brief was generated by GPT-6 Sol from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The North Korea attribution rests on the CEO's assessment; the supplied record provides no independent confirmation.