Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
Summary: Bitget reported that suspected North Korean threat actors stole $351.6 million from its hot and warm wallets after compromising a critical backend system in its wallet infrastructure, which was used to spoof transaction data and trigger its authorization process. The exchange suspended withdrawals, engaged Mandiant and SlowMist, and said on-chain tracing later showed roughly $390.06 million moved to attacker-controlled addresses, with Circle and Tether freezing $339,100 in linked stablecoins.
Key Takeaway: The attacker did not break cryptography or a smart contract; it compromised a backend system and turned Bitget's own authorization process into the withdrawal mechanism, which is the same class of failure that sits behind every privileged internal service in your estate. Elliptic and TRM Labs tied the laundering wallets to prior DPRK-attributed exploits including Bybit, and TRM put 2026 at $1.04 billion in North Korean crypto theft if attribution holds.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026