Bitget Lost $387.5 Million Without Touching a Key: The Backend That Tricked Its Own Approval System

Bitget reopened Bitcoin withdrawals after North Korean-linked attackers drained $387.5 million from its wallets last week. The breach never touched a private key. It went through the exchange’s own authorization pipeline.

The exchange paused all withdrawals on Thursday, September 24, after monitoring flagged unauthorized transfers leaving a small number of wallets. CEO Gracy Chen said initial figures put the damage at $351.6 million; on-chain tracing by Friday pushed the final number to $387.5 million, spread across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. ETH withdrawals reopen on September 29 at 08:00 UTC, USDT on September 30, and the remaining assets, fiat and P2P on October 2.

The backend lied, and the approval system obliged

The part that should keep a fintech CISO up at night: Chen says the attackers breached a critical backend system inside Bitget’s wallet infrastructure and used it to spoof transaction data. Those spoofed records then triggered the exchange’s own authorization process, which moved the funds out with full internal blessing. Nothing was cracked and no signing key leaked. A trusted internal component talked its way past the controls meant to catch exactly this.

Marketing pages love to point at audit trails and custody models. Neither mattered here. Bitget’s hot wallets probably held what policy said they should hold. The problem is the path that authorizes movement, which sat upstream of every check that mattered, and that path trusted its own inputs.

A state treasury with better dwell times than your intrusion set

Chen attributed the attack to North Korean groups, citing on-chain analysis and IP behavior patterns, and the pattern fits. Blockchain analytics firm Elliptic put the running DPRK crypto theft tally, going back to 2017, at more than $6 billion as of February 2025, and that number has had twenty months to grow since. The largest heist on record, $1.5 billion taken from Bybit’s ETH cold wallet, carries the same fingerprints. These are not hobbyists in hoodies. They are a sanctioned state’s revenue operation, staffed full-time, and they treat exchanges the way an extractor treats a mine.

Bitget’s response is worth reading for its honesty about what recovery looks like in this industry: a Protection Fund covering the loss, a 5% bounty on recovered or frozen funds, and staged withdrawal reopening. The company insists user balances are unaffected and that no further unauthorized transfers are possible. I’d hold that confidence lightly. Whether customers believe it depends on when a real technical post-mortem lands, and none has yet.

What African fintechs should take from this

South Africa and Nigeria consistently rank near the top of global crypto adoption, and most of that volume sits on exchanges their users never audit. Bitget turns out to be retail risk. If you run any platform that moves value in this market, the questions are the ones Bitget’s auditors will be asking:

• Which components can submit transaction data to the authorization pipeline, and is that interface treated as internal-trusted or as hostile input?
• Does an out-of-policy withdrawal get checked by something that lives on a different trust path than the one under attack?
• Can you tell the difference between a legitimate high-volume withdrawal window and an attacker spoofing one? Bitget’s monitoring caught transfers only after they started.

The eHawu take

Every serious exchange incident of the past three years, Bybit through Bitget, is a story about internal trust paths rather than external walls. eHawu enforces the network layer between the systems inside your own perimeter: service-to-service traffic gets authenticated, and the paths that move money are segmented from the paths that merely describe it. If a compromised backend component cannot address the approval system directly, because that system only accepts identity-verified traffic from an authorized segment, the Bitget failure mode becomes a blocked connection and a log line. African fintechs building on-chain rails should treat network-layer zero trust as a product feature, not compliance overhead.