Bitget, a cryptocurrency platform, was hit by a cyberattack that transferred about $387.5 million in digital assets to addresses controlled by the attackers, in what security intelligence firm TRM Labs described as the largest cryptocurrency theft by value so far this year.
Backend wallet-management system exploited
Bitget raised its initial estimate of the losses from $351.6 million to $387.5 million after including additional assets on the Zcash and Tron networks. The platform's systems detected unauthorized transfers from some of its wallets at 18:31 UTC on September 24, triggering emergency response procedures and a temporary halt to withdrawals.
Bitget Chief Executive Gracy Chen said the attack did not involve the theft of private wallet keys, but targeted a backend system linked to the wallet infrastructure. The attackers manipulated transaction data sent to the authorization system, making the malicious transfers appear legitimate and allowing them to pass through the approval mechanism.
The company said the affected funds were spread across layers of hot and warm wallets used to process transactions, while cold wallets, which hold most of the assets offline and away from direct internet connectivity, remained secure. In a later update, it added that its team had identified the attack path and exploited vulnerability and fixed the flaw, alongside an independent investigation by Mandiant and SlowMist.
Movements across multiple networks and assets
The affected assets included XRP, Ethereum (ETH), Tether (USDT), ZEC, USDC, USDT0, XAUt, BNB, AVAX and Tron (TRX). The funds moved across several networks, including Ethereum and networks compatible with it, the XRP Ledger, Zcash and Tron.
TRM Labs' analysis showed that a large portion of the funds was split among new addresses over a short period, while other portions moved through various platforms and protocols in an attempt to make them harder to track and recover. The company also detected the conversion of some assets into other currencies, including funds that moved toward the Bitcoin network through cross-chain exchange services.
Chen said preliminary indicators, including internet address patterns and on-chain fund movements, made the involvement of attackers linked to North Korea a strong possibility. TRM Labs pointed to links with patterns seen in previous thefts attributed to North Korean entities, while stressing that the attribution was not definitive.
Protection fund and withdrawal resumption plan
Bitget said user balances were unaffected and that its cold wallets and Bitget Wallet, a self-custody wallet operating on separate infrastructure, were not impacted by the incident. It said the loss was covered by the user protection fund, whose value exceeded $464 million when the attack occurred.
The company said the suspension of withdrawals was a precautionary measure to conduct a comprehensive security review, while trading and deposits continued. It also identified the addresses linked to the stolen funds, notified law-enforcement agencies and companies specializing in blockchain security, and brought in Mandiant and SlowMist to investigate and track the movement of the assets.
Bitget launched a rewards program offering the equivalent of 5% of the funds that any party successfully freezes or recovers, subject to the program's terms. It said some of the affected assets had been frozen in cooperation with platforms, companies and projects in the cryptocurrency sector.
The platform began gradually restoring withdrawals, resuming Bitcoin withdrawals on September 28, followed by Ethereum on September 29 and Tether on September 30. Withdrawals of the remaining assets and fiat currencies, along with peer-to-peer trading, were scheduled to resume on October 2 after security testing for each phase was completed.
