Bitget attributes $351.6M hot-wallet drain to North Korean TTPs via backend abuse

The exchange detected the drain through its own monitoring and stated that on-chain flows and IP patterns matched prior North Korean operations. Mandiant and SlowMist were retained; several blockchain foundations froze linked addresses. Cold storage remained untouched and the attacker obtained fraudulent transfer approvals through the compromised backend rather than key theft.

North Korean groups have executed repeated large-scale crypto thefts since 2017, with documented proceeds exceeding $3 billion according to Chainalysis 2024 and 2025 reports. The February 2025 Bybit incident, publicly attributed by the FBI, followed similar infrastructure-abuse vectors. Bitget’s refusal to name a specific group leaves the attribution at the level of tradecraft match rather than confirmed actor linkage.

The incident highlights persistent concentration risk in centralized exchange hot wallets even when cold storage is segregated. Backend systems controlling transfer approvals remain high-value targets where logging and multi-party controls are often weaker than key-management practices.

Next steps include full forensic handover to law enforcement and expected on-chain tracing by blockchain analytics firms; historical patterns show 40-60 percent of such funds reach mixers or DeFi within 90 days.