Bitget Confirms $387.5 Million Loss in Backend System Hack, Suspects North Korea

A $387.5 million theft—an amount equal to more than 80 percent of the exchange's entire emergency protection fund—was drained from the cryptocurrency platform Bitget on Thursday. Attackers bypassed the platform's private keys entirely by compromising the backend system that authorizes withdrawals, forcing a halt to all customer outflows while the company investigates.[1][2][3]

The unauthorized transfers began at 18:31 UTC on September 24, hitting the exchange's hot and warm wallet infrastructure. Bitget initially estimated the losses at $351.6 million before revising the total upward on Friday to account for additional assets taken across the Zcash and TRON networks.[3]

Bitget CEO Gracy Chen stated that the attackers did not steal the exchange's private keys. Instead, they breached a critical backend component, spoofed transaction data, and manipulated the system into approving the fraudulent transfers itself. The company's offline cold wallets, which require physical authorization outside the network, were not affected by the intrusion.[1][2]

During a town hall address, Chen attributed the attack to North Korean hacking groups. She cited IP addresses, behavioral patterns, and on-chain signatures that align with the state-sponsored actors responsible for billions of dollars in cryptocurrency thefts over the past five years.[1][2]

The stolen assets span multiple blockchains and include Ethereum, XRP, USDC, and several other major tokens. Blockchain security firms tracked more than $175 million leaving the platform in the initial wave before the larger chunks were consolidated and moved.[2]

Bitget has suspended all customer withdrawals while it conducts a security review alongside the cybersecurity firms Mandiant and SlowMist. The exchange emphasized that customer account balances remain accurate and that deposits and trading services are continuing to operate normally.[2][3]

The exchange has promised to make users whole using its User Protection Fund, which currently holds more than $464 million. “Bitget has navigated multiple market cycles. We will not run from this. Every dollar and every decision will be accounted for, transparently and in full,” Chen said. She pointed to the survival of other platforms following massive breaches, noting that “if Bybit can hold on [after] a $1.5 billion loss, we can definitely hold on to a $350 million+ loss.”[2]

To incentivize the return of the assets, Bitget established a recovery bounty program. The exchange is offering a 5 percent reward to platforms that voluntarily freeze the attacker's funds, and another 5 percent for successful recoveries. Several platforms have already frozen a portion of the funds connected to the hackers' wallets.[2][3]

The incident highlights a shift in attacker tactics away from cryptographic brute force and toward exploiting the internal administrative systems that manage exchange liquidity. Bitget stated it will not resume withdrawals until the security review confirms the platform is completely safe, leaving users waiting for a definitive timeline on when they can move their assets.[1][2][3]