The private key wasn’t leaked—what was lost was trust in the wallet’s backend.

In this incident where Bitget was stolen of $351.6 million, the explanation CEO Gracy Chen gave on X was: the attackers hacked the wallet backend and forged the transfer data—not that the private key was stolen. That detail is worth dissecting more than the loss amount itself.

According to her September 25 tweet, after the attacker breached the wallet backend system, they injected fabricated transaction instructions into it. The wallet thought it was executing a legitimate transfer, but in reality the assets were sent to the attacker.

There’s a technical fork in the road here. If the private key was leaked, the problem lies in key custody; if the backend was fed forged data, the problem lies in “who has the authority to tell the wallet to make a transfer.” The latter is more troublesome because the signature itself could be genuine.

Bitget confirmed on September 24 a security incident involving $352 million and suspended withdrawals. The official statement said the affected was a “limited number of hot wallets,” while cold wallets and most of the platform’s assets were not touched.

But on-chain data doesn’t really support this claim. Decrypt reported that within less than an hour, a newly created wallet drained the hot-wallet and cold-wallet reserves across multiple chains that were labeled as belonging to Bitget. If the cold wallet truly wasn’t affected, this “both hot and cold being drained together” scene doesn’t add up.

In another tweet, Gracy Chen said that in the initial investigation, the attacker’s IP address matched VPN options commonly used by the North Korea (DPRK) hacking group. She suspects it was done by North Korea.

This North Korea label isn’t new in crypto circles. But honestly, an IP matching a VPN is not strong evidence at all. There are many people using VPNs—North Korean hackers use them too, and so do ordinary users. Using it as a basis for public suspicion is understandable, but it’s not hard evidence.

The real problem is the security model. Exchange wallets are usually designed like this: hot wallets hold everyday liquidity, cold wallets hold most of the assets, and transfers require multiple signatures or manual approvals. If the backend can be compromised via forged data, then these processes are basically just a formality.

The attacker doesn’t need to steal private keys—he only needs the system to believe that “this transfer is legitimate.” The person approving sees a normal-looking withdrawal, and the signing party signs a normal transaction. By the time anyone realizes it, the money is already moving on-chain.

This is a different kind of incident from a private key leak. A private key leak is a custody problem, while a backend compromise via forged data is a logic problem. Logic problems are harder to prevent because you don’t know what the attacker has inserted into the system.

Bitget isn’t the first. There have already been several attacks following similar paths this year—just with smaller amounts. The $352 million figure, in 2026, currently ranks among the top in magnitude.

If the North Korea suspicion is confirmed, subsequent accountability will become very complicated. On-chain tracking, exchange freezing, and law-enforcement coordination are basically ineffective against North Korean hackers. They usually use mixers, cross-chain bridges, and over-the-counter trades, and ultimately convert the funds into cash or stablecoins.

On the regulatory side, the U.S. Treasury and the United Nations have long lists of sanctions against North Korean IT workers and hacking organizations. But sanctions are one thing; recovering funds is another.

For Bitget, the most urgent things right now are twofold: proving users’ funds are safe, and explaining whether the cold wallets were actually touched. The official says “users’ funds are safe,” but during the withdrawal suspension, users can’t verify that statement.

When I looked through the data, I noticed that after this incident, BGB’s price reaction wasn’t particularly strong. The market seems to have gotten used to news of exchanges being hacked—so long as it doesn’t involve misappropriation on the scale of something like FTX, people treat it as a technical incident.

But that’s exactly the problem. A technical incident involving $352 million would be enough for traditional finance to make global headlines for days. In crypto, it’s just another case of “the wallet backend being compromised.”

North Korean hackers, forged transfer data, and hot and cold wallets being drained together—these three things put together point to an uncomfortable conclusion: the security model of many exchanges is designed to prevent external intrusions, but not internal logic from being tampered with.

Compromise of a wallet backend via forged data is harder to investigate than a private key leak, and harder to prevent than a private key leak.