Bitget Backend Spoofing Enables $351.6M Hot Wallet Drain

The exchange reported unauthorized transfers of ETH, XRP, BNB, AVAX, USDT and USDC across seven chains beginning at 18:31 UTC. Cold storage and customer balances remained untouched, withdrawals were paused, and Mandiant plus SlowMist were retained. No indicators of compromise, CVE references, or packet captures have been released. The company described the vector as backend spoofing that triggered legitimate authorization flows.

IP telemetry and on-chain clustering cited by Bitget align with prior TraderTraitor-linked operations, including the 2024 Bybit and KelpDAO drains. SentinelOne’s recent attribution of the same group to an Indian IT-services target supplies the only external pattern match; independent forensic confirmation of infrastructure reuse or code similarity is absent. Procurement records show North Korean groups have repeatedly targeted exchange custody stacks, yet public IOCs remain limited to wallet addresses.

The absence of disclosed intrusion telemetry leaves open whether the backend flaw was zero-day, supply-chain, or credential-based. Chain foundations have frozen select attacker addresses, but recovery volume is unknown. Similar incidents show exchanges typically restore liquidity within 30-60 days via insurance or treasury, yet regulatory filings on the loss have not surfaced.

Mandiant and SlowMist reports due in October are expected to clarify whether the compromise originated inside wallet microservices or adjacent orchestration layers. Exchanges handling comparable hot-wallet volumes are reviewing authorization replay defenses in parallel.