Bitget Breach Exposes How Crypto Exchange Security Can Be Defeated Without Breaking a Single Private Key

A sophisticated attack on cryptocurrency exchange Bitget drained roughly $387.5 million from the platform this week—without ever touching a private key. Instead, the intruders manipulated the exchange’s own internal authorization machinery, turning Bitget’s systems into unwitting accomplices in one of the largest digital asset thefts of 2025.

The method itself is more alarming than the dollar figure. Attackers penetrated a backend component of Bitget’s wallet infrastructure and generated forged transaction data that the platform’s security protocols accepted as legitimate. Users did not receive suspicious withdrawal prompts, and the cryptographic keys protecting cold storage remained untouched. The breach bypassed the perimeter entirely by exploiting trust in the system’s internal signaling—essentially convincing the exchange to approve its own payouts.

The attack was first detected at 18:31 UTC on September 24, when security monitoring flagged unusual outflows from Bitget’s hot wallets. Within roughly an hour, on-chain analysts had traced approximately $183 million in stablecoins and Ethereum-class assets moving toward attacker-controlled addresses. The tally continued climbing throughout the day, reaching $351.6 million by the time Bitget issued a public statement and ultimately settling at $387.5 million.

The single largest component of the stolen assets was approximately 103 million XRP, valued near $157 million. Blockchain investigators, including pseudonymous researcher DCF GOD, documented how the attacker converted roughly $19.67 million in cross-chain stablecoin USDT0 into nearly 7,111 ETH within six minutes, paying about 5% above market rates through decentralized aggregators UniswapX and 1inch Fusion. Assets were subsequently dispersed across at least five separate blockchains—a technique consistent with rapid obfuscation practices.

Bitget CEO Gracy Chen attributed the breach to actors affiliated with North Korea, citing matching IP address patterns and on-chain signatures resembling techniques linked to state-linked hacking groups. She noted she had personally been targeted by the same network before, losing approximately $80,000 from a private wallet outside the exchange. Chen stressed that attribution has not been formally confirmed and no technical evidence has been publicly released.

The attribution claim fits a well-documented pattern. North Korea’s Lazarus Group—also tracked as TraderTraitor—has been responsible for some of the most devastating crypto heists in history, including the February 2025 Bybit breach that resulted in $1.4 billion in losses, later confirmed by the FBI. Analytics firm Chainalysis estimates North Korean-linked thefts exceeded $2 billion in 2025 alone, making the regime one of the most persistent and profitable threats in digital asset security.

Despite the scale of the loss, Bitget moved quickly to insulate its customers. Deposits and trading remained operational throughout the incident. Only withdrawals were frozen as a precaution. The exchange’s User Protection Fund, established years ago and valued at over $464 million, will absorb the entire loss, leaving customer account balances unaffected. That fund was set at $300 million as recently as 2023 and has grown to reflect the increasing frequency of platform-level breaches across the industry.

Bitget has committed to publishing a full incident report once its engineering teams complete system remediation. Withdrawals are expected to resume with a detailed restoration plan announced the following day. The episode underscores a growing vulnerability in the crypto exchange sector: the most damaging attacks no longer require breaking encryption or stealing keys, but instead exploit the internal processes that platforms trust implicitly.