Bitget Attributes $387.5M Crypto Heist to North Korean Hackers
Exchange revises loss figures as industry rallies with support and intelligence sharing.
1Revised hack impact
Bitget initially reported $351.6M stolen but updated the figure to $387.5M after discovering additional affected assets on Zcash and TRON. Blockchain analysts at Arkham tracked $228M leaving Bitget's wallets in just 18 minutes. The stolen assets included $153M in XRP from a cold wallet, plus $66.2M ETH and $34.8M USDT. The attack spanned multiple networks including Ethereum, Arbitrum, and BNB Smart Chain.
2Security response activated
Bitget engaged cybersecurity firms Mandiant and SlowMist to investigate the breach. Their preliminary findings indicate hackers compromised the wallet service's backend to forge transfer authorizations, ruling out private key leakage. Withdrawals were temporarily suspended for additional security checks, though deposits and trading remain operational. The exchange confirmed no customer balances or cold wallets were compromised in the incident.
3Industry support network
Major exchanges including Binance, MEXC, and Bybit pledged operational support to Bitget. Binance shared intelligence to trace stolen funds, while Bybit referenced reciprocal aid after its own $1.5B North Korean-linked hack in 2025. This collaboration highlights crypto's collective security approach, where competitors unite against common threats. The industry's User Protection Funds now face their largest test since their inception.
4North Korea's crypto track record
The attack bears hallmarks of Lazarus Group operations, with IP patterns and on-chain signatures pointing to North Korea. The regime has targeted multiple exchanges including Bybit, DMM Bitcoin and WazirX. Their 2025 Bybit heist remains the largest recorded crypto theft. These state-sponsored attacks fund weapons programs while evading international sanctions, making crypto exchanges high-value targets for Pyongyang's cyber warfare units.
5Financial safeguards intact
Bitget maintains $464M in its User Protection Fund and over $1B in corporate assets, with all wallets publicly verifiable. CEO Chen emphasized 1:1 user fund coverage despite the breach. The exchange launched a 5% bounty for recovered funds, creating economic incentives against money laundering. These measures aim to maintain trust while investigators trace the stolen assets across blockchain networks.
6Technical breach methodology
Hackers exploited the wallet service's backend system to forge transfer information and bypass authorization protocols. Unlike private key compromises, this method suggests vulnerabilities in transaction signing processes rather than fundamental cryptography failures. Bitget's security team confirmed no further outflow risks after containing the breach. A full technical report will detail the intrusion vectors once the investigation concludes.
7Operational continuity measures
Bitget Wallet, the exchange's self-custody product, operates on separate infrastructure and remains unaffected. The company emphasized regional hub operations continue normally despite the attack's timing during Asia's Mid-Autumn Festival. This geographical distribution provides operational resilience, though some speculate holiday staffing may have delayed initial breach detection by approximately 30 minutes.
8Regulatory implications
The heist underscores persistent security challenges in decentralized finance, where rapid transactions collide with irreversible settlements. While Bitget's Seychelles registration limits direct oversight, the incident may accelerate global coordination on exchange security standards. The involvement of state actors adds geopolitical dimensions to what regulators traditionally view as financial cybersecurity matters.