Bitget: Attackers faked wallet system, not keys; North Korea suspected

The hacker still possesses substantial amounts of XRP and ether, which could create downward price pressure if the funds are quickly sold instead of being slowly laundered. XRP is particularly noteworthy: at about $157 million, it represents the largest single component of the stolen assets, and it had received little notice before the incident. For Bitget's BGB token, the assurance that private keys were not compromised may alleviate concerns that a key leak could have endangered more wallets. Chen's assertion that the exchange can withstand a withdrawal surge will be tested when withdrawals are reopened.

The attackers did not break into the secure vault; they tampered with the documentation, and Bitget is now relying on $1.5 billion of reserves and capital to convince customers it can cover losses.

Summary:

• Attack method: According to Bitget's initial investigation, hackers infiltrated a critical backend wallet system, falsified transfer details, and initiated the exchange's standard signing process. Private key compromise has been ruled out.
• Current status: Bitget states that damage control is finished and no additional funds are at risk, though the precise entry point remains under investigation.
• North Korea link: CEO Gracy Chen stated the attack is very likely connected to North Korean hackers, noting IP addresses that resemble VPN patterns of a DPRK-linked group, but emphasized this is not fully confirmed.
• Assets stolen: Lookonchain's analysis includes approximately 102.9 million XRP ($157.5 million), 31,890 ETH ($85.8 million), along with USDT, USDC, USDT0, Tether Gold, BNB, AVAX, and TRX, totaling about $357 million.
• Financial resources: Chen said the protection fund, currently over $465 million, alone covers the loss, and Bitget has more than $1 billion of its own capital. She compared Bitget to Bybit, which recovered from a $1.5 billion hack.
• Withdrawal status: Withdrawals are still suspended, while trading operations continue.

Bitget states that the hackers did not obtain the private keys to its wallets. Rather, they infiltrated a key backend system of its wallet service and deceived it into authorizing transfers, resulting in about $351.6 million being taken from the exchange on Thursday. CEO Gracy Chen additionally stated that the attack is very probably tied to North Korean hackers, but she noted that the attackers' identity remains unconfirmed.

A preliminary report from Bitget's security team, as relayed by Wu Blockchain, indicates that the attackers falsified transfer information within the wallet system and then activated the exchange's standard authorized signing procedure to move the funds. Bitget has stated that exposure of private keys has been eliminated as a possibility. The exchange also said that damage control steps are complete and that no additional funds are at risk, though the exact method of entry is still being probed.

For those unfamiliar with crypto, this resembles invoice fraud in a traditional company. The criminals did not take the manager's signature. They accessed the payment system, altered the details, and let the company's own approval process authorize the transfer. This is significant because it indicates a vulnerability in Bitget's internal procedures, not in the cryptographic security of wallets.

Data from on-chain tracker Lookonchain reveals that the stolen funds were distributed among at least nine different tokens. The largest amount was about 102.9 million XRP, valued at approximately $157.5 million, followed by 31,890 ether worth about $85.8 million. The remainder consisted mainly of stablecoins pegged to the US dollar: about $34.8 million in USDT, $21.1 million in USDC, and $19.7 million in USDT0. There were also smaller quantities of Tether Gold (backed by gold), plus BNB, AVAX, and TRX. These totals come to roughly $357 million based on the prevailing prices, close to Bitget's own figure.

That distribution could account for why initial on-chain estimates were significantly smaller. CoinMarketCap observed that trackers had detected only about $183 million being moved. The XRP component alone is roughly $157 million, implying—though not proven—that the early tallies largely overlooked the XRP transactions. A substantial portion of the stolen stablecoin holdings was swiftly swapped for ether, a token that no central issuer can freeze.

During a livestream, Chen stated that certain IP addresses used in the attack closely resembled VPN patterns linked to a North Korean-aligned group. State-sponsored North Korean hackers have been accused of several major crypto thefts, such as the approximately $1.5 billion stolen from competitor Bybit in February 2025. Chen herself made that comparison, asserting that Bitget's retail operations are comparable in scale to Bybit's, and that if Bybit could withstand a $1.5 billion loss, Bitget can handle a loss of just over $300 million.

Chen also dismissed parallels with FTX, the exchange that failed in 2022 following misuse of client funds, saying "Bitget is nothing of the kind." She stated that the protection fund, currently exceeding $465 million, alone can offset the losses, and that Bitget possesses over $1 billion of its own capital additional to that, sufficient to manage a surge of withdrawals.

The key development to monitor is the resumption of withdrawals, which were still halted at the time of the latest update, and whether clients will hurry to withdraw funds once possible. That will truly test Chen's assertion that Bitget can survive a bank-run-like scenario. The complete incident report, pledged within a day of the breach, should also reveal how the attackers accessed the backend system and whether the North Korea connection can be verified. Until then, Bitget's assurances are merely the company's own word.