Bitget's own authorization process approved $351.6M in transfers built on spoofed data

The attacker "compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out," Bitget CEO Gracy Chen said ^[3]. A dev.to write-up of the incident notes that no private key was reported stolen and no signer was reported bribed ^[4]. The approval process ran as designed. It approved transactions built from false data ^[4].

A generic hot-wallet withdrawal runs in order. First a backend builds the transaction: asset, amount and destination. A policy engine then checks that description against rules, sometimes with a human approver as well. Last, a signer signs the payload. Each stage after the first reads what the first one wrote. If an attacker controls the builder, every later stage is checking a request the attacker wrote. The write-up puts the result directly. An approval chain that trusts upstream data it cannot verify independently "only confirms that the data is internally consistent" ^[16].

Nobody has said yet how the attacker reached that backend. Bitget's statement says "The specific method of system intrusion remains under active investigation." ^[12]

I think the next control a custodian buys should be independence. A second approver who reads the same forged screen adds delay and nothing else. A useful check takes an input the transaction builder cannot write. One example is a destination allowlist that the signing component holds and that changes only through a separate path. Another is reconciling each outbound transfer against customer withdrawal requests kept in another system. Either one means the attacker has to break into a second system.

Bitget handled containment well. The exchange says its cold wallets and "the overwhelming majority of platform assets" were not affected ^[6]. Bitget Wallet, the self-custodial product, runs on separate infrastructure and was not affected ^[14]. Mandiant and SlowMist are running an outside investigation ^[8]. Bitget says no further unauthorized transfers are possible and customer balances remain accurate ^{[10] [7]}.

Chen said the attack method was "highly consistent with known patterns of North Korean hacker organizations," based on IP behavior patterns and on-chain analysis ^[11]. Bitget has not named a group. Its claim goes only as far as that consistency ^[15]. The Hacker News noted that the disclosure came about a week after SentinelOne attributed an attack on an India-based IT services company to TraderTraitor. That North Korea-linked group is best known for taking $1.5 billion from Bybit and $292 million from KelpDAO's LayerZero bridge ^[13]. The write-up argues that the most costly crypto thefts now target the systems around the signing step: the backend that prepares transactions, the interface that displays them, and the vendors and IT providers that can reach both ^[17].