Cryptocurrency exchange Bitget Says North Korea

A cryptocurrency exchange named Bitget reported that suspected North Korea-linked threat actors stole $351.6 million from specific hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals. Bitget maintained that customer balances, cold wallets, and most platform assets remained secure. Investigations are underway with independent third parties Mandiant and SlowMist. The exchange stated that user balances were intact and the User Protection Fund covered the impact across the platform.
The security incident reportedly affected assets across several blockchains, including ETH, XRP, BNB, AVAX, USDT, and USDC. The attackers allegedly compromised a backend wallet system, spoofed transaction data, and bypassed authorization to move funds. Bitget has engaged blockchain foundations to have hacker wallets frozen on affected chains. The company noted that the Bitget Wallet operated on separate infrastructure and was unaffected by the incident.
The attribution to North Korea-linked threat actors is based on IP behavior patterns and on-chain analysis conducted by Bitget, which suggested consistency with known patterns of North Korean hacker organizations. This context is set against a broader trend where cryptocurrency exchanges are targeted by actors employing sophisticated methods, including cyber intrusions and false identities.

* Bitget reported that suspected North Korea-linked threat actors stole $351.6 million from hot and warm wallets.
* Unauthorized transfers were detected on September 24.
* Bitget temporarily suspended withdrawals following the detection of unauthorized transfers.
* Customer balances, cold wallets, and most platform assets remain secure according to Bitget.
* Mandiant and SlowMist are investigating the incident.
* The security breach affected ETH, XRP, BNB, AVAX, USDT, and USDC across several blockchains.
* The attack involved compromising a backend wallet system, spoofing transaction data, and bypassing authorization.
* Bitget contacted affected blockchain foundations to freeze hacker wallet addresses.
* Bitget Wallet operated on separate infrastructure and remained unaffected by the incident.
* The attack method is consistent with known patterns of North Korean hacker organizations based on IP behavior and on-chain analysis.

The narrative balances a specific financial loss event with a geopolitical attribution, creating a layered reality where technical security failures intersect with state-sponsored cyber activity. The apparent defense—reassuring users that core assets were secure while acknowledging significant losses—suggests a deliberate management of public perception versus internal operational reality. The consistent link drawn between the attack method and known North Korean hacker patterns functions as an appeal to established, albeit unverified, knowledge regarding threat actors. This pattern implicitly frames the incident not as an isolated system failure, but as an extension of ongoing state-level conflict into the digital domain.
The focus on freezing wallets through blockchain foundations highlights a specific response mechanism for decentralized assets, emphasizing a reliance on the decentralized community for remediation rather than solely relying on central authority responses. This creates a space where sovereignty over digital assets is contested between the compromised exchange, the affected chains, and the alleged threat actors. The persistent linkage to known state-linked groups taps into existing anxieties about digital security and geopolitical risk, potentially shaping public perception regarding the vulnerability of decentralized finance systems to external influences.
The implication for agency lies in the asymmetry: while technical safeguards (like the Bitget Wallet) are presented as isolated successes, systemic vulnerabilities exploited across multiple chains demonstrate that control is fragmented. The persistence of narrative framing around North Korean actors risks overshadowing the operational reality of distributed security protocols and forces an inquiry into whether decentralized mechanisms offer true resilience against state-level kinetic threats or if they simply become new, complex targets for attribution and exploitation.
Bridge Questions: How does the reliance on third-party investigative bodies like Mandiant and SlowMist inherently shift accountability during high-stakes incidents? What are the long-term structural implications when asset freezing relies on external blockchain foundations rather than centralized legal mandates? If attack patterns are consistently linked to state actors, what responsibility do decentralized platforms bear in mitigating risks beyond immediate custody?