- The Record reports Bitget, a Singapore crypto exchange, lost an estimated $387.5 million after attackers breached a backend wallet system. Its CEO calls the figure an initial estimate, and withdrawals were suspended.
- Bitget's CEO ties the attack to North Korea-linked groups, and outside analysts report links to past Lazarus Group thefts. The Record does not cite a formal finding by authorities.
- Organisations with crypto custody or treasury exposure should ask vendors how wallet transfers are monitored, whether reserve funds are independently verified, and what happens if withdrawals are suspended.
Bitget Says Attackers Breached a Backend Wallet System
The Record reports that Bitget, a crypto exchange based in Singapore, lost upward of $387 million to attackers who got in on Thursday. Tracking firms saw an opening wave of more than $175 million leave the platform, and the source says bigger sums were taken after that. CEO Gracy Chen said the security team detected unauthorized transfers and activated emergency protocols. She later said an investigation found that attackers had breached a backend system of Bitget's wallet services and exploited vulnerabilities to enable transfers of ETH, XRP, USDC and other coins. Chen described the $387.5 million figure as an initial estimate, so the final total may change. Withdrawals were suspended as of The Record's Sept 25 report, while Bitget works with security firms Mandiant and SlowMist.
Attribution Rests on the CEO's Account and Outside Tracing
In later remarks, Chen pointed to IP addresses, behavioural patterns and on-chain signatures as the basis for tying the attack to groups linked to North Korea. Other blockchain experts tracking the funds reported links to past thefts by Lazarus Group, which The Record describes as accused of several high-profile heists. The Record's account attributes the link to the company and outside analysts and does not cite a formal finding by authorities. Bitget said it has notified law enforcement and other crypto platforms. For scale, The Record cites UN investigators: the North Korean government took more than $2 billion through comparable attacks last year, and earned $3 billion from strikes on crypto platforms between 2017 and 2023.
The Precedent the CEO Cited
During the town hall, Chen pointed to North Korea's $1.5 billion theft from Dubai-based Bybit last year, noting that Bybit survived it. "We can definitely hold on to a $350 million+ loss," she said, adding that Bybit held on after its own bank run and liquidity issue. That is a company executive's argument about resilience, not evidence of how Bitget's recovery will go. The Record also reports that earlier this year North Korean hackers allegedly stole $280 million from Kelp and $290 million from Drift in an operation reportedly involving fake companies.
The Reserve Fund and the Bounty
Chen said Bitget's User Protection Fund holds over $464 million and will be used to cover the losses. On the stated figures, the fund exceeds the initial loss estimate, though the estimate may move and the fund's size is the company's own statement. Bitget also launched a recovery bounty: platforms that voluntarily freeze attacker funds receive 5%, and another 5% is paid if funds are recovered. By Chen's account, several other platforms have already frozen some of the money connected to the attackers' wallets.
Questions for Your Team
For any organisation with crypto custody, payments or treasury exposure, the reported breach of a backend wallet system raises questions to put to vendors. Which backend systems handle wallet transfers, and what monitoring flags anomalous transfer patterns in real time? Does any vendor holding company funds maintain a loss-absorbing reserve, and is its size and liquidity independently verified rather than self-reported? What is the contractual and operational plan if a custodian suspends withdrawals, and how does that map to your own liquidity needs? Finally, Bitget notified law enforcement and other platforms after the incident, and other platforms have reportedly frozen funds. Does your incident response plan set up those contacts before an incident, not only after?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
