Bitget says the attacker behind its $351.6 million security breach did not steal the exchange’s private keys, narrowing the investigation toward a compromise of the backend infrastructure responsible for preparing and authorizing wallet transactions.
The clarification came on September 25, one day after Bitget detected unauthorized transfers from portions of its hot and warm wallet infrastructure. The breach itself is not new: Bitget first detected the activity at 18:31 UTC on September 24 and subsequently suspended withdrawals while investigating the incident.
What changed Friday was the exchange’s explanation of how the attacker apparently reached the funds.
Attacker Allegedly Manipulated the System Feeding Bitget’s Authorization Process
CEO Gracy Chen said Bitget’s security team had made initial progress tracing the attack and had ruled out a private-key compromise. According to Chen, the attacker instead compromised a critical backend system inside Bitget’s wallet infrastructure, used that access to spoof transaction data and then triggered the company’s authorization process to move funds out.
That distinction is important because it suggests the cryptographic keys controlling the affected wallets were not themselves extracted. Instead, Bitget’s preliminary explanation points toward an attacker manipulating the infrastructure that supplied transaction information to the authorization layer.
In practical terms, a signing or authorization system can still approve a malicious transfer if the information presented to it has already been compromised upstream. Similar questions about whether legitimate authorization mechanisms were fed malicious data have appeared in other crypto incidents, including the recent Payy bridge exploit, where investigators have focused on how an apparently authorized state update was able to drain backing assets.
Chen said Bitget has contained the loss and that additional unauthorized transfers are no longer possible. The precise method used to gain control of the backend system, however, remains under investigation.
XRP Accounts for the Largest Identified Share of the Theft
On-chain estimates have provided a more detailed picture of what left Bitget. Lookonchain identified approximately 102.93 million XRP worth about $157.5 million as the largest single component, followed by 31,890 ETH valued near $85.8 million.
The estimated stolen portfolio also included roughly $34.75 million in USDT, $21.05 million in USDC and $19.67 million in USD₮0, alongside Tether Gold, BNB, AVAX and TRX.
Those figures are external on-chain estimates rather than Bitget’s final transaction-level accounting. Their combined dollar value can also vary with token prices, which helps explain why some on-chain tallies have moved above the exchange’s approximately $351.6 million headline estimate.
The stablecoin portion creates a separate recovery dynamic. Centralized stablecoin issuers retain the ability to restrict specific addresses, something already visible in cases where Tether has frozen specified wallets. Attackers therefore have an incentive to move rapidly into assets such as ETH that do not have an issuer capable of directly blacklisting balances.
Bitget Says a North Korea Link Is “Very Likely,” but Attribution Remains Preliminary
The second major development is the emerging possibility of North Korean involvement.
Chen said investigators identified IP addresses that appeared to match VPN choices associated with a DPRK-linked group, leading her to describe North Korean involvement as “very likely.” She stopped short of presenting that assessment as a completed attribution, and Bitget has not publicly released enough forensic evidence to independently establish who conducted the intrusion.
A separate on-chain lead came from investigator Specter, who said XRP stolen from Bitget and subsequently bridged across chains could be connected to funds associated with the approximately $24 million AFX Trade attack in July.
Specter said that earlier attack had been linked to TraderTraitor, a cluster associated with North Korean operations and the wider Lazarus ecosystem. The connection is potentially significant, but it remains an investigator’s attribution rather than a formal determination that the same actors breached Bitget.
There is, however, established precedent for the threat actor. The FBI formally attributed the roughly $1.5 billion Bybit theft in February 2025 to North Korean TraderTraitor activity. U.S. authorities have also tied TraderTraitor and Lazarus-linked actors to multiple earlier cryptocurrency thefts.
Withdrawals and the Protection Fund Are Now the Immediate Tests
Bitget says its cold wallets were not affected and that customer balances remain protected. The company has said its User Protection Fund is worth more than $464 million, placing the stated fund value above the estimated $351.6 million loss.
Withdrawals nevertheless remained suspended in Bitget’s latest updates Friday morning while technical teams continued remediation and security checks. Deposits and trading remained available, and Chen said the exchange would not announce a withdrawal-reopening timetable until it was confident the deadline could be met.
That makes withdrawal restoration one of the most important practical indicators to watch. Crypto platforms can absorb a direct financial loss while still facing an operational confidence problem if customers cannot move their assets. The industry saw the same distinction on a much smaller scale when Blink restored services after a breach involving custodial accounts: asset reimbursement, technical containment and normal customer access are separate stages of recovery.
The Bigger Security Problem Sits Before the Private Key
For investors, the most important part of Bitget’s explanation may be what was not compromised.
Private keys are usually treated as the final crown jewels of crypto custody. Protect them properly and the assumption is that the wallet remains secure. The Bitget incident shows why that model is incomplete for a centralized exchange processing enormous numbers of transactions automatically.
A private key does not decide whether a transaction makes business sense. It signs what the surrounding infrastructure tells it to sign.
If an attacker can manipulate the data entering that workflow, strong key storage alone may not prevent the loss. That shifts attention toward transaction-generation systems, internal permissions, independent verification of signing instructions, segregation between wallet layers and whether authorization systems can detect that a technically valid transaction is operationally abnormal.
That is arguably the more uncomfortable lesson here. Bitget says its keys survived, its cold storage survived and the loss was contained. Yet hundreds of millions of dollars still left the platform because another component in the transaction pipeline allegedly failed.
The DPRK Evidence Needs to Be Separated From the Technical Evidence
The North Korea angle will naturally dominate headlines, especially given the scale of past Lazarus-linked crypto thefts. But there are two separate questions here: how Bitget was breached and who actually carried out the breach.
Bitget now has a preliminary explanation for the first question. The attacker compromised backend wallet infrastructure and manipulated transaction data before authorization. The second question is much less settled.
VPN similarities are an investigative clue, not proof of identity. On-chain connections to funds associated with a previous attack can strengthen an attribution case, but they can also require careful interpretation because stolen funds, intermediary wallets, bridges and laundering infrastructure can overlap.
The stronger case will come from combining multiple forms of evidence: server forensics, malware or credential evidence, infrastructure reuse, transaction patterns, operational mistakes and the subsequent movement of stolen funds. Until that work is complete, “very likely” should remain exactly that — a preliminary assessment rather than a confirmed attribution.
What Happens Next Matters More Than the Initial Loss Figure
Bitget now has three separate problems to solve at the same time.
First, it has to prove that the backend attack path has actually been eliminated rather than merely blocked temporarily. Second, it needs to restore withdrawals without introducing another vulnerability while rebuilding or rotating wallet infrastructure. Third, it must demonstrate that its Protection Fund can absorb the loss exactly as advertised without creating a new liquidity problem elsewhere.
The $351.6 million figure is enormous, but the financial loss alone will not determine the lasting impact. If withdrawals resume normally, customer balances remain intact and Bitget publishes a convincing technical post-mortem with concrete control changes, the incident could ultimately be treated as a large but contained security failure.
If withdrawal restrictions persist, the loss estimate rises materially or the eventual investigation reveals that the authorization architecture had broader weaknesses, the market will begin asking a much harder question: not simply how one backend system was compromised, but how much trust centralized exchanges should place in automated infrastructure sitting between their private keys and the outside world.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape.