Bitget has disclosed a $388 million hack that drained its hot wallets, an attack the exchange says was 'highly consistent with known patterns of North Korean hacker organizations.' The company froze withdrawals after blockchain researchers flagged the suspicious outflows. When withdrawals reopened, it didn't take long for the scale to show.
One hour, 4,098 bitcoin
More than 4,000 bitcoins — worth over $334 million — left the exchange within a single hour of withdrawals resuming. CEO Gracy Chen said Bitget processed 9,585 orders for 4,098 bitcoins in that window, a figure that tells you just how many users were waiting at the door the moment it cracked open.
The exchange framed the incident as the first 'security incident of this nature in eight years' — a line that reads less like a reassurance and more like a marker of how the last week has gone.
What the attackers actually took
No cold storage funds were touched. That's the part Bitget wants heard. Instead, the attackers exploited vulnerabilities in third-party products to steal internal credentials, then pushed fraudulent withdrawal commands through the exchange's own systems — bypassing its risk controls entirely. It's a familiar playbook: don't break the vault, borrow the keys.
Bitget said the attack method matched patterns linked to North Korean government-backed hacking groups, which have spent years targeting crypto exchanges and are generally considered among the most sophisticated operators in the space.
The protection fund problem
Bitget's protection fund stood at $464 million before the hack. It's now below $200 million, and the company says it's using its own money to top it back up. That's a hole of more than a quarter-billion dollars in a reserve users are meant to lean on when things go wrong — and it happened in a matter of days.
The exchange is the sixth biggest by trading volume, processing $811 million in transactions over the past 24 hours. Its customer base is mostly in Asia.
Withdrawals are back on, for now
Bitget has resumed withdrawals and is publicly working through the mechanics of the outflow — order counts, bitcoin figures, which wallets got hit. What it hasn't said is how the third-party vulnerability was introduced, which products were involved, or whether those credentials are now dead.
The protection fund refill is the number to watch. Bitget has committed to covering the shortfall with its own balance sheet, but there's no timeline attached to it yet, and until the fund is back near its pre-hack level, every large withdrawal is going to be read as a test of how much cushion is actually there.
