Adversary Intelligence — 2026-09-29

North Korean Lazarus Group Linked to 388 Million Dollar Bitget Crypto Exchange Theft Pushing 2026 DPRK Cyber Haul Past One Billion

BLUFFormal US government attribution of the Bitget theft to North Korea by October 31 is unlikely, leaving Pyongyang's billion-dollar cyber haul validated only by private-sector tracing.

Bitget detected unauthorized transfers from its hot and warm wallets at about 18:31 UTC on September 24, and CEO Gracy Chen said the loss was $351.6 million with cold storage unaffected 12. Chen said attackers compromised a backend system and spoofed transaction data, that no private key was compromised, and that IP addresses tied to VPN services used by a North Korean group were identified 13. TRM Labs has not definitively attributed the attack, but reported on-chain overlaps with laundering wallets from the Bybit and AFX Bridge thefts 1. Elliptic assessed a DPRK link as highly likely and put its 2026 DPRK-attributed total past $1 billion 2, while TRM counts about $690 million attributed so far excluding Bitget 1.

Analysis
US government public attribution of the Bitget theft to North Korea by October 31 is unlikely. Washington named Bybit's perpetrators within days, but only after direct FBI forensics, and no comparable US investigative role has surfaced here. Attribution rests on Elliptic and TRM's independent on-chain tracing plus the exchange's own claims, which the major outlets merely relay, and Bitget has not published the basis for its VPN finding. Harder evidence within days could speed a statement, yet formal agency attribution routinely takes over a month. Confidence is high, because every source points to the same actor while none shows US involvement. The laundering overlaps and VPN indicators could instead reflect another actor reusing DPRK-associated infrastructure, which would leave the FBI with no basis to attribute. Bitget lifts Elliptic's 2026 DPRK tally past $1 billion from roughly $580 million. Absent a government statement, exchanges must freeze downstream deposits on commercial attribution and their own risk tolerance rather than with sanctions-grade legal cover.

5 sources