Bitget's preliminary probe blames a backend wallet service for its $351.6 million loss

A freshly created wallet spent $19.67 million in USDT0 on 7,111 ETH in six minutes, according to the pseudonymous researcher DCF GOD, who flagged it before Bitget had confirmed anything ^[7]. It paid roughly 5% above market through UniswapX and 1inch Fusion ^[7]. That works out to about $2,766 per ETH ^[3], and a premium of roughly $940,000 for the speed ^[4].

"They did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet," chief executive Gracy Chen said ^[5]. Her version is preliminary. Chen wrote that the investigation with Mandiant and SlowMist is ongoing and that thorough forensic analysis takes more than 24 hours ^[14].

If her account holds, I think the diligence question for anyone with balances at an exchange is what the signing system checks before it approves a transfer. The follow-up is whether a compromised internal system can feed that check false data, as Chen says happened here ^[6]. The view fails if the forensics turn up a stolen credential or key. Bitget would then be an ordinary custody failure. It is incomplete if the loss keeps growing, as it already has, from roughly $183 million in the first hour to $351.6 million when Bitget went public and $387.5 million a day later ^[3][4]. For users, the reserve matters more than the method, since Chen says their balances stay whole either way ^[10].

The cost falls on that reserve. Paying $387.5 million out of a fund of more than $464 million leaves at least $76.5 million ^[1]. That is about a quarter of the $300 million the fund held in 2023, when it was set aside to cover hacks and theft ^[12][6]. The source does not say what assets the fund holds. The $387.5 million is itself a market valuation, and about 40% of it is the XRP position ^[5], so the dollar cost of replacing the stolen coins moves with one token's price.

Chen has been careful on attribution. "We've identified some IP addresses that match the VPN choices by a certain DPRK group," she said, adding that "the pattern looks very much like what the North Korean team did before" ^[13]. She stressed that the attacker's identity has not been confirmed ^[13]. In the Bybit case, a $1.4 billion loss in February 2025, the FBI confirmed North Korean involvement weeks later ^[15].