Bitget reported a $351.6 million wallet breach on September 24, with analysis suggesting the attack bears the hallmarks of North Korean hackers. The exchange said IP activity and blockchain transaction patterns closely matched techniques used by known North Korean hacking groups and has enlisted security firms Mandiant and SlowMist to investigate.
Onchain analyst Specter linked XRP stolen from Bitget to assets taken during the $24 million AFX hack in July, which was attributed to the TraderTraitor cluster associated with North Korea's Lazarus Group. Bitget's attribution remains under investigation and has not yet been independently confirmed by its external security firms.
The breach affected multiple assets including ETH, XRP, BNB, AVAX, USDT, and USDC across seven blockchain networks. XRP represented the largest single loss on any network, according to CEO Gracy Chen. Bitget said cold wallets remained secure and its separately operated self-custodial wallet product was unaffected.
Several blockchain foundations have already confirmed freezes of addresses associated with the attacker, which could reduce final losses if assets are successfully recovered.
Protection Fund Under Strain
Losses will be covered by Bitget's User Protection Fund, which holds 5,500 Bitcoin valued at more than $464 million. A loss equal to the full $351.6 million estimate would represent approximately 76% of the fund's value. The eventual draw could be smaller depending on asset recovery and Bitcoin's price movements.
Chen disclosed that Bitget has more than $1 billion in proprietary assets beyond the protection fund and said customer funds remain backed on a 1:1 basis. The company has yet to specify how much of those resources will be needed or how much will come directly from the protection fund.
Bitget's latest proof-of-reserves report, published September 17, showed an aggregate reserve ratio of 135% across 19 assets, though the snapshot preceded the attack and does not reflect the exchange's current position.
Withdrawals remain suspended while Bitget completes additional security reviews. CEO Chen said the company will announce a reopening window once it can do so with confidence rather than committing to a specific timetable.
