Bitget hack: attackers faked transfers, not keys, as CEO points to North Korea

<p dir="ltr">The attacker still controls a large amount of XRP (chart above not showing much impact for now) and ether (chart below), a potential source of selling pressure on both if the funds are sold on the market rather than laundered slowly through privacy tools. XRP is worth watching in particular: at roughly $157 million, it is the biggest single part of the haul, and it had drawn little attention before today's breakdown. For Bitget's BGB token, the confirmation that no private keys were leaked may ease one fear: a key leak could have put more wallets at risk. Chen's claim that the exchange can survive a rush of withdrawals will face its first real test when withdrawals reopen.</p><p dir="ltr">---</p><p dir="ltr"> Bitget's hackers did not crack the vault, they forged the paperwork, and the exchange is now betting $1.5 billion of reserves and capital that customers will believe it can pay.</p><p dir="ltr">Summary:</p><ul dir="ltr"><li>How the attack worked: Bitget's preliminary finding is that hackers breached a critical backend wallet system, forged transfer details and triggered the exchange's normal authorised signing process. It says private key leakage has been ruled out.</li><li>Status: Bitget says damage-control measures are complete and no further funds are at risk. The exact entry point is still under investigation.</li><li>North Korea: CEO Gracy Chen said the attack is highly likely linked to North Korean hackers, citing IP addresses that match VPN patterns of a DPRK-associated group, though this is not yet 100% confirmed.</li><li>What was taken: Lookonchain's breakdown includes about 102.9 million XRP ($157.5 million), 31,890 ETH ($85.8 million), plus USDT, USDC, USDT0, Tether Gold, BNB, AVAX and TRX, roughly $357 million in total.</li><li>Resources: Chen says the protection fund, now above $465 million, covers the loss alone, and Bitget holds more than $1 billion in its own capital. She compared Bitget to Bybit, which survived a $1.5 billion hack.</li><li>Withdrawals: They remain frozen, while trading continues.</li></ul><p dir="ltr"> Bitget says hackers did not steal the keys to its crypto wallets. Instead, they broke into a critical backend system of its wallet service and tricked it into approving transfers, moving about $351.6 million out of the exchange on Thursday. Chief executive Gracy Chen also said the attack is highly likely linked to North Korean hackers, although she stressed the identity of the attackers is not yet confirmed.</p><p dir="ltr">According to a preliminary finding from Bitget's security team, reported by Wu Blockchain, the attackers forged transfer details inside the wallet system and then set off the exchange's normal, authorised signing process to send the funds out. Bitget said leakage of its private keys, the secret codes that control a crypto wallet, has been ruled out. It also said damage-control measures are complete and there is no further risk of losing funds, although the exact way the attackers got in is still under investigation.</p><p dir="ltr">For readers new to crypto, a useful comparison is invoice fraud at an ordinary company. The thieves did not steal the boss's signature. They got into the payments system, changed the payment details, and let the company's own approval process sign off the transfer. That distinction matters because it points to a weakness in Bitget's internal systems rather than in the cryptography that protects crypto wallets.</p><p dir="ltr">A breakdown from on-chain tracker Lookonchain shows the stolen assets were spread across at least nine tokens. The largest was about 102.9 million XRP, worth roughly $157.5 million, followed by 31,890 ether worth about $85.8 million. The rest was mostly stablecoins, digital tokens pegged to the US dollar, including about $34.8 million of USDT, $21.1 million of USDC and $19.7 million of USDT0. There were also smaller amounts of Tether Gold, a token backed by physical gold, as well as BNB, AVAX and TRX. Those figures add up to roughly $357 million at the prices used, close to Bitget's own estimate.</p><p dir="ltr">That breakdown may explain why early on-chain estimates were so much lower. CoinMarketCap noted trackers had only seen about $183 million leave. The XRP portion alone is worth roughly $157 million, which suggests, though it is not confirmed, that the early counts largely missed the XRP transfers. Much of the stolen stablecoin balance was quickly converted into ether, which no central issuer can freeze.</p><p dir="ltr">Speaking during a livestream, Chen said some IP addresses used in the attack closely match VPN patterns tied to a group associated with North Korea. North Korean state-linked hackers have been blamed for several of the largest crypto thefts on record, including the roughly $1.5 billion taken from rival exchange Bybit in February 2025. Chen drew that comparison herself, arguing that Bitget's retail business is similar in size to Bybit's, and if Bybit could survive a $1.5 billion loss, Bitget can absorb one of just over $300 million.</p><p dir="ltr">Chen also rejected comparisons with FTX, the exchange that collapsed in 2022 after customer funds were misused, saying Bitget is nothing of the kind. She said the protection fund, now above $465 million, can cover the losses on its own, and that Bitget holds more than $1 billion of its own capital on top of that, enough to handle a rush of withdrawals.</p><p dir="ltr">What to watch next is the reopening of withdrawals, which remained suspended at last report, and whether customers rush to move money out when they can. That will be the real test of Chen's claim that Bitget can absorb a run. The full incident report, promised within 24 hours of the breach, should also show how attackers reached the backend system and whether the North Korea link can be confirmed. Until then, Bitget's reassurances remain the company's own account.</p><p dir="ltr"></p> This article was written by Eamonn Sheridan at investinglive.com.