Bitget, one of the larger cryptocurrency exchanges, said on Friday that attackers had drained more than $350 million from some of its wallets, and that it had frozen all customer withdrawals while it works out what happened. The company said the pattern of the attack points to a group operating on behalf of North Korea.
The theft hit the wallets an exchange keeps connected to the internet, known in the trade as hot and warm wallets, so that trades and withdrawals can go through quickly. Bitget said its cold wallets, which are stored offline, and the large majority of customer assets were untouched, and that trading and deposits kept running normally even as withdrawals were paused.
What the company says happened
By Bitget's account, its monitoring systems flagged a series of unauthorized transfers out of a small number of wallets on Thursday evening, and the breach was confirmed from there. The company says the attackers got into a critical part of the backend that manages its wallets, used that access to fake transaction details, and then pushed those fake transfers through the system that is supposed to authorize movements of funds. It says it has since shut the door on any further rogue transfers, but exactly how the intruders reached that backend system is still being investigated.
The losses were spread across several blockchains, including Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base, and touched many different tokens. The company says the single largest loss was in XRP. It has brought in law enforcement and outside security firms, naming Mandiant and SlowMist among those helping with the investigation, and says some of the networks involved have already frozen the wallet addresses the attacker used.
Who is being blamed
Bitget's chief executive, Gracy Chen, tied the theft to North Korea, saying the methods and the behavior seen in the network traffic and the movement of the stolen funds matched what is already known about North Korean crews. That attribution came quickly and from the victim rather than from a government agency, so it is worth treating as the company's working assessment rather than a settled conclusion.
It would not be an isolated case. North Korean groups have been linked to a long run of exchange thefts, including the theft of about $1.5 billion from Bybit earlier, which stands as the largest single crypto heist on record. Western investigators have for years connected these operations to the funding of the country's weapons programs.
Whether customers lose out
The more reassuring part of the disclosure, if it holds, is that Bitget says users will not be left to absorb the loss. The company points to what it calls a User Protection Fund, which it says holds more than $464 million, roughly 5,500 bitcoin, and which is meant to cover exactly this kind of event. Customer balances are accurate, it says, and it intends to turn withdrawals back on as soon as investigators confirm it is safe.
That promise is the thing to watch. An exchange of this size can usually cover a loss on paper, but a freeze on withdrawals is also the moment when confidence in a platform is tested, and users have learned to judge these events by whether the money actually comes back rather than by the size of a reserve fund. For now the practical position for Bitget customers is simple: deposits and trading work, withdrawals do not, and the company has not said how long that will last.
A recurring weak point
The detail that stands out for anyone running a platform is where the attack landed. This was not a stolen password on a single customer account or a drained cold wallet. It was the internal machinery that signs off on transfers, the system an exchange trusts to tell the difference between a real instruction and a forged one. When that layer is compromised, the attacker does not need to break the cryptography or guess a key; they get the system to approve their withdrawals as if they were legitimate. It is the same category of weakness that has turned several of the biggest exchange thefts from account level fraud into eight and nine figure losses.
