Bitget says suspected North Korean-linked attackers stole as much as $387.5 million after breaking into a backend wallet system and pushing unauthorized transfers through its approval flow. Earlier estimates put the loss at about $351.6 million, and the exchange says it moved into containment and third-party investigation.
The attackers did not need Bitget’s wallet keys. Bitget said the intruders spoofed transaction data inside the internal wallet path, which made the platform’s own authorization process treat the transfers as legitimate. That means the failure sat in the withdrawal-control plane, not in customer accounts or cold storage alone.
For custodians, the lasting exposure is any internal service that can approve withdrawals on behalf of the platform. If that backend is compromised, the exchange itself can become the signer of unauthorized transfers, even when most assets remain in cold wallets and user balances still look normal.