Bitget Reports $351.6M Crypto Theft by North Korean Hackers

En bref

• Bitget disclosed a breach today involving North Korean hackers.
• Roughly $351.6 million in cryptocurrency was taken.
• Hot and warm wallets were affected.
• No CVE was cited; severity is rated medium.

Bitget has disclosed that its platform was breached today by actors tied to North Korea. According to the exchange, digital assets were removed from both hot and warm wallets, with an estimated loss of about $351.6 million. The company characterized the event as a theft and confirmed that its exchange infrastructure was compromised.

The incident centers on Bitget's wallet operations, particularly the hot and warm storage layers used to support trading and liquidity. Those systems are typically more accessible than cold storage, making them a priority target for financially motivated intrusion sets. The disclosure indicates a direct loss of customer-facing exchange assets rather than a theoretical vulnerability.

Why this matters goes beyond a single platform. North Korean hacking groups have repeatedly pursued cryptocurrency exchanges because large, irreversible transfers can generate significant revenue. A nine-figure loss from operational wallets can affect user confidence, trigger withdrawals, and invite regulatory scrutiny. No CVE identifiers were associated with the incident, suggesting the root cause may involve access compromise, insider risk, or process failure rather than a publicly cataloged software flaw.

What to watch now is whether Bitget provides additional detail on the attack path, whether any funds are frozen or recovered, and how blockchain analytics firms trace the movement. Exchange operators should expect heightened attention from customers and regulators. The severity remains medium based on the available facts, but the financial scale and state-linked attribution make the case significant for the broader crypto sector.

À faire maintenant

1. Immediately rotate all API keys, signing credentials, and access secrets tied to hot and warm wallet infrastructure.
2. Move remaining liquid funds into cold storage or multisignature custody with dual approval and withdrawal limits.
3. Isolate affected systems, preserve forensic evidence, and review authentication logs for unauthorized access.
4. Enforce quorum-based transaction signing, hardware-backed key storage, and strict separation of duties for wallet operations.
5. Monitor blockchain activity for the stolen funds and coordinate with law enforcement, regulators, and blockchain analytics providers.
6. Review third-party integrations and privileged accounts for signs of compromise, then revoke unnecessary access.
7. Communicate transparently with customers and stakeholders according to the incident response plan.

Source originale

BleepingComputer