Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise

Attackers suspected to be North Korean state-sponsored actors compromised Bitget's backend wallet infrastructure and spoofed transaction data to siphon funds from hot and warm wallets — the highest-risk storage tier in any crypto exchange. The root cause centers on insufficient access controls and segmentation around backend systems that had direct authority over live wallet operations. This attack illustrates the catastrophic financial and reputational damage that results when privileged backend systems are reachable, poorly monitored, and able to authorize large-scale fund movements without additional verification layers. The fact that cold wallets remained secure confirms that air-gapped, isolated storage can limit blast radius, but the hot/warm wallet exposure was devastating. Incidents of this magnitude underscore why cryptocurrency platforms are prime targets for sophisticated nation-state actors seeking to fund sanctioned regimes.