The crypto market received a new serious warning signal.
September 24 Bitget discovered unauthorized transfers from its hot and warm wallets. Initially, the exchange estimated the damage at $351.6 million, but after additional analysis the amount was revised to $387.5 million. (Bitget)
But the most interesting part here is that the hackers did not steal private keys.
According to Bitget, the attackers gained access to a critical backend system within the wallet infrastructure and replaced transaction data in such a way that the internal authorization system considered the operations legitimate. (Bitget)
So the problem turned out not to be that someone simply “stole a wallet key.”
The problem was that the system itself granted permission to withdraw funds.
💰 What was stolen?
According to on-chain analytics:
• about 102.9 million XRP — ~$157 million
• about 31,890 ETH — ~$86 million
• USDT, USDC and other assets
• BNB, AVAX, TRX and tokenized gold XAUt
XRP became the largest single portion of the stolen funds. (Gizmodo)
Who is behind the attack?
Bitget and the analytical company Elliptic point to signs that may link the attack to North Korean hacking groups. However, final attribution is still under investigation. (Elliptic)
And that’s especially important: don’t treat the link to the DPRK as a confirmed fact until the investigation is completed.
🛡️ What will happen to Bitget users?
Bitget claims that the damage is covered by its User Protection Fund, which is larger than $464 million.
The exchange also reported that the vulnerability has already been fixed, and that Mandiant and SlowMist are handling the investigation together with Bitget. (Bitget)
🔥 But the main question now is different.
If the attacker managed to get the exchange’s internal system to confirm fake transactions on its own, then the security question is no longer only about Bitget.
How well are similar backend systems protected at other centralized exchanges?
That’s exactly what I would be watching right now.
For the market, this may be more important than the $387.5 million amount itself.
This is my personal analysis of the current events, not a financial recommendation.