Overview
- Attackers stole about $387.5 million from portions of Bitget’s hot and warm wallets after unauthorized transfers were detected on Sept. 24, and the exchange says cold wallets and private keys were not compromised.
- Investigators say a zero-day in third-party backend security software let the attackers obtain high-level internal credentials and submit forged withdrawal commands that bypassed normal approval checks.
- The thieves first swapped assets that centralized issuers could freeze, then routed funds across Ethereum, the XRP Ledger, Zcash and Tron and used cross-chain liquidity services such as THORChain to consolidate roughly $269 million toward Bitcoin.
- Chainalysis and other analytics firms publicly linked the on-chain patterns—especially fast XRP-to-BTC swaps—to DPRK-linked actors and reported that in-house AI cut multi-chain bridge-matching from more than 20 hours to under 10 minutes, though no law-enforcement agency has made a public attribution.
- Bitget says its User Protection Fund will cover customer losses, has resumed phased withdrawals and is offering bounties for freezes and recoveries, but only about $840,000 (roughly 0.2%) of the stolen funds has been frozen and most value remains obfuscated or attacker-controlled.