Bitget said it suffered a security breach on Thursday night that drained more than $387 million from the platform, making it the largest cryptocurrency hack of the year to date.
CEO Gracy Chen said in a three-hour livestream on X that Bitget suspects North Korean attackers exploited a backend system used to process wallet transactions, making fraudulent withdrawals appear legitimate. Chen said the attackers did not steal private keys, but instead tricked Bitget's internal approval system into authorizing the transfers.
Bitget said the unauthorized transfers were limited to its hot and warm wallets, which are company-controlled pools of crypto used to process customer trades and withdrawals. Bitget Wallet, a separate self-custodial product in which users control their own crypto, was not affected.
The exchange said it has fixed the vulnerability and paused withdrawals while it continues to review the platform's security. It also launched a recovery-bounty program offering rewards of up to 5% for funds successfully frozen or recovered, and released a real-time tracking dashboard to help outside researchers and other platforms identify the attacker's wallets.
The revised loss estimate reflects additional transactions identified on networks including Zcash and TRON. BGB, Bitget's native token, dropped almost 7% to $1.93 and later traded at $1.97.
Bitget said its user protection fund holds more than $464 million, enough to cover the current loss if the stolen funds cannot be recovered.
North Korea has become one of the crypto industry's most prolific hacking threats. According to blockchain analytics firm Chainalysis, North Korean-linked hackers stole a record $2 billion in cryptocurrency in 2025. Chainalysis said the groups increasingly target exchanges and other large crypto firms by placing IT workers inside companies, posing as recruiters to steal credentials and approaching executives with fake investor pitches.
The market has already voted. When exchanges depend on opaque internal controls and a few hidden approval systems, capital can disappear in hours and margins get turned inside out. The taxpayer is not the backstop here, but the lesson is familiar: free enterprise needs real security, not just fast growth and a branding exercise.
Bitget's response will now be judged by whether it can restore trust as quickly as it can freeze or recover funds. In crypto, sovereignty over assets depends on more than slogans. It depends on controls that work when the pressure is real.
