Highlights
- Bitget lost roughly $351.6 million after attackers compromised a backend system in its wallet service.
- The exchange says private keys were not exposed and customer balances remain intact.
- CEO Gracy Chen pointed to IP and VPN patterns consistent with a North Korea-linked group; a separate monitoring firm tied the attack to Lazarus Group's TraderTraitor cluster.
- A user protection fund holding roughly 5,500 BTC, worth about $464 million, will absorb the loss.
Bitget's wallet infrastructure was breached this week in an attack that has already cost the exchange more than $351 million, and the fallout is now pointing toward North Korea's state-linked hacking apparatus. On-chain analytics firm Lookonchain tracked the stolen funds as they moved, tallying roughly 102.93 million XRP, 31,890 ETH, 34.75 million USDT, 21.05 million USDC, 19.67 million USD₮0, 3,000 XAUt, 12,719 BNB, 821,012 AVAX and 20.59 million TRX pulled from Bitget's hot wallets. Within hours, the attacker had already routed most of the EVM-chain portion of the haul into 67,982 ETH, worth close to $183 million at the time, a swap pattern consistent with efforts to consolidate stolen assets into a single liquid token before cashing out.
Bitget's own account of how the breach happened, relayed through the exchange's Greater China lead, described attackers infiltrating a critical backend system tied to its wallet service rather than stealing private keys directly. Using that access, the intruders reportedly forged transfer instructions and triggered the exchange's own authorization signing process to move funds out, a method that let them bypass safeguards without ever touching Bitget's cold storage or exposing key material. CEO Gracy Chen said that distinction matters because it rules out the more severe scenario of a private key leak, and the company says it has already stopped further outflows, with parallel technical teams now working on system repairs and security hardening ahead of restoring withdrawals.
Attribution is still taking shape, but the early signals point in a consistent direction. Chen said Bitget's security team identified IP addresses whose VPN usage patterns matched infrastructure previously associated with North Korean state-backed hacking operations. Blockchain monitoring firm Specter went further, linking the intrusion to Lazarus Group and specifically to the TraderTraitor cluster, the same set of actors the FBI has attributed to earlier exchange breaches. Specter also drew a connection to a smaller, roughly $24 million attack on AFX in July, suggesting the group may have been probing exchange infrastructure for months before the larger Bitget strike landed. No government agency has issued a formal attribution yet, so these remain preliminary findings rather than confirmed conclusions.
Related: Japan, US, Germany Jointly Expose North Korea's WaterPlum Crypto Hackers
Bitget says the financial hit will not fall on users. The exchange's protection fund, which it says holds about 5,500 BTC (worth roughly $464 million at current prices) and is verifiable on-chain across publicly disclosed wallet addresses, will absorb the loss and be replenished afterward, with specific compensation terms to be announced separately. That fund was built for exactly this kind of platform-level security event, and Bitget has framed the response as evidence the reserve is doing its job rather than a one-off improvisation. The exchange has also brought in an outside security firm to run an independent forensic review, alongside its internal teams, to confirm the attack vector and support any law enforcement cooperation before publishing a full incident report.
The crypto industry's response has leaned toward solidarity rather than schadenfreude. Bybit CEO Ben Zhou said his team stands ready to help Bitget in whatever way it can, a nod to the fact that Bitget offered support when Bybit suffered its own major hack earlier this year. That earlier Bybit incident was also eventually linked to North Korean operators, reinforcing a pattern in which the same actors appear to be cycling through major exchanges as targets. For an industry that has now watched several nine-figure breaches unfold in similar fashion this year, this one lands as a reminder that backend infrastructure, not just cold-wallet custody, is where the next fight over exchange security is likely to be fought. Coverage of a similar pattern is detailed in Japan, US, Germany Jointly Expose North Korea's WaterPlum Crypto Hackers.
Bitget has not committed to a firm timeline for reopening withdrawals, saying only that it will announce one once there is genuine certainty rather than promise a date it cannot keep. That caution mirrors lessons from other recent incidents where exchanges rushed public reassurances before investigations were complete, as seen in Fake AI Trading Bot Tutorials on YouTube Drained 274.6 ETH From 224 Victims and Meter Exploit Drains $2.3M as Attacker Mints Unbacked wMTRG, both of which involved attackers exploiting trust in a platform's existing infrastructure rather than a single point of failure. For now, Bitget's user balances remain accounted for, its cold wallets remain untouched, and the exchange's protection fund appears equipped to cover the shortfall, leaving the bigger open question as attribution and the broader pattern of North Korea-linked operators targeting exchange backends rather than any near-term risk to depositors.
