Overview of the Bitget Hack
The cryptocurrency exchange Bitget has disclosed a significant security breach, where hackers stole $387.5 million from its hot and warm wallets. This amount is an update from the initial reported $351.6 million, based on the latest on-chain tracing and transaction classification. The incident has raised concerns about the security measures in place and the involvement of known cyber threat groups, particularly those linked to North Korea.
The Incident Details
Initial Discovery: Bitget’s security systems flagged multiple unauthorized transfers from a limited number of crypto wallets on Thursday evening. The company suspected North Korean hackers were behind the breach, given the pattern of unauthorized activity.
Investigation and Response: Bitget has temporarily suspended all withdrawals while investigating the incident. They have sought assistance from law enforcement agencies, on-chain security institutions, and cybersecurity experts at Mandiant and SlowMist. The company has also confirmed that its self-custodial Bitget Wallet was not affected, as it operates on independent infrastructure.
Impact and Recovery: Bitget’s cold wallets and the overwhelming majority of platform assets remain secure and unaffected. The User Protection Fund, which holds 5,500 BTC worth about $464 million, will cover all losses. The company has yet to share more information on how the attackers accessed its key backend wallet-service system.
The Role of North Korean Hackers
The incident falls within the coverage of Bitget’s User Protection Fund, which currently holds more than $464 million. Customer account balances remain accurate, and deposits and trading continue to operate normally. The company has reported to relevant institutions and is fully cooperating in conducting a global investigation. The attack method is highly consistent with known patterns of North Korean hacker organizations.
Broader Context and Future Actions
Blockchain Analysis and Threat Groups: Blockchain analysis company Chainalysis previously reported that state-backed North Korean hacking groups stole $1.34 billion in 47 crypto heists throughout 2024. Elliptic estimated in February 2025 that North Korean hackers have "stolen over $6 billion in crypto assets since 2017, with the proceeds reportedly spent on the country's ballistic missile program."
Regulatory and Enforcement Actions: The involvement of North Korean hackers in major crypto theft incidents has raised questions about the regulatory and enforcement responses. It is unclear whether any individuals or organizations are being held accountable for these incidents. The broader cybersecurity landscape is also under scrutiny, with concerns about the effectiveness of existing security measures and the potential for similar attacks in the future.
Recommendations for Organizations
Enhanced Security Measures: Organizations should consider strengthening their security protocols, including the use of zero-day detection systems and continuous monitoring of backend systems. They should also be prepared to handle potential breaches and ensure that their User Protection Funds are adequately funded.
Cybersecurity Tools and Expertise: Companies can leverage advanced cybersecurity tools and expertise to identify and mitigate threats. This includes using AI-driven cybersecurity solutions, such as OpenAI’s GPT-6 Cyber AI, which has found 81 Firefox flaws and 948 Linux bugs.
Regular Audits and Risk Assessments: Regular audits and risk assessments should be conducted to identify vulnerabilities and potential attack vectors. This includes monitoring for unusual activity and conducting regular penetration testing to ensure systems are secure.
Employee Awareness and Training: Organizations should also focus on employee awareness and training to prevent social engineering attacks, such as phishing and business email compromise. Tools like Adaptive Security’s AI agents can help in uncovering these threats.
Conclusion
The Bitget hack underscores the importance of robust cybersecurity measures and the need for continuous improvement in the face of evolving cyber threats. The involvement of known threat groups, such as North Korean hackers, highlights the need for stronger regulatory and enforcement actions to address these issues. As the cybersecurity landscape continues to evolve, it is crucial for organizations to stay vigilant and proactive in protecting their assets and systems from potential cyber threats.