$350 million stolen—did the funds flow to a North Korean hacker vault? Tracking Bitget’s hack

This weekend’s biggest news in the crypto world isn’t the market—it’s that Bitget’s hot wallet was drained of $351.6 million. The main stolen assets include XRP (repeated), ETH, USDT, USDC, $BNB, and AVAX. Bybit’s LazarusBounty data shows that, as of the evening of the 25th, the total reached $387 million.

On the 25th, on-chain investigator Specter published a report saying that after the stolen $XRP was bridged across chains, the cluster of incoming address groups completely overlapped with the wallets used in the July this year Arbitrum case involving AFX Trade, where $24 million was stolen—and that case has already been attributed to TraderTraitor, which operates under Lazarus. The attacker first transferred out 20 million XRP, of which about 328,000 were bridged to an Ethereum address (0xa07f…6feb) via the NEAR Intents cross-chain bridge. This cross-chain step ended up becoming the key to solving the case.

CEO Gracy Chen said that the security team’s initial assessment is that the key backend system of the wallet infrastructure was compromised. The attackers forged transaction data and triggered an authorization process to transfer the funds, ruling out a private key leak. Some related IPs match those used by a certain North Korean hacking group for VPN services, but the attacker’s identity has not yet been finally confirmed.

As for compensation, Bitget has promised full reimbursement from its protection fund. Officially, the protection fund exceeds $464 million, and its own assets exceed $1 billion, with user funds covered 1:1. Bybit CEO Ben Zhou also said that he will provide tracking support for LazarusBounty. Previously, when Bybit was hacked, Bitget had provided free support of 40,000 $ETH; this time, it’s essentially repaying a favor.

Most unusual is the price of $XRP. 100 million XRP were stolen, and the funds were routed to a hacker organization—so it should be a bearish factor. Yet on the 26th, XRP still rose 1.4%, to $1.5652. The market is becoming increasingly desensitized to such events; the correlation between coin prices and exchange security incidents is weaker than it was a few years ago.#BTC走势分析