> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Crypto CEO accuses North Korea of stealing $387 million from Bitget platform - URL: https://f4n6.co.uk/security-feed/crypto-ceo-accuses-north-korea-of-stealing-387-million-from-bitget-platform/ - Published: 2026-09-25T16:17:33.000Z - Updated: 2026-09-25T16:17:33.000Z - Author: Jeff Davies - Tags: #security-feed, Lazarus ## 1\. Executive summary Bitget, a Singapore-based cryptocurrency exchange, suffered a breach on Thursday 24 September 2026 in which attackers moved more than $387.5 million in ETH, XRP, USDC and other assets off the platform. CEO Gracy Chen attributed the theft to North Korean-linked hackers on the basis of IP addresses, behavioural patterns and on-chain signatures, and blockchain analysts independently linked the stolen funds to past Lazarus Group heists. Lazarus Group is tracked by MITRE as G0032; the attribution in this item rests on the exchange's own investigation and third-party on-chain tracing, not on a vendor incident report, and should be treated as probable rather than confirmed. EMEA financial services exposure is indirect but real: any client holding Bitget in a crypto counterparty chain, or clearing stablecoin flows that touch Bitget wallets, faces frozen-withdrawal and tainted-funds risk. Withdrawals remain suspended and the recovery effort is being run by Mandiant and SlowMist. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 28: ICT third-party risk, general principles | Bitget is a crypto counterparty or custody-adjacent service in the supply chain of any client that holds balances or routes stablecoin settlement through it, and withdrawals are currently suspended. | Clients must identify whether Bitget appears in their register of ICT third-party providers and assess contractual and operational exposure to the suspension. | | DORA Art. 30: key contractual provisions with ICT third-party providers | The loss is being covered by Bitget's own User Protection Fund ($464 million) rather than by insurance or a contractual guarantee, which is the kind of recovery arrangement Art. 30 requires to be documented. | Clients relying on a Bitget protection fund as a recovery mechanism should confirm that arrangement is written into the contract and is adequate against the loss. | | NIS2 Art. 21(2)(d): supply chain security measures | The breach originated in a backend wallet-services system at a third party, and the attacker's funds are being traced across multiple exchanges. | Entities in scope must be able to show supply chain security measures covering crypto counterparties, not just conventional IT vendors. | No DORA incident-reporting obligation is engaged for EMEA clients by this item on its own: the incident is at Bitget, not at the client, and Art. 19 reporting is triggered by a major ICT-related incident at the reporting entity. If a client's own operations are disrupted by the withdrawal suspension, Art. 17 and Art. 18 become live and the classification process should be run. ## 3\. Technical analysis & attack chain The source material describes the incident at a high level. The following steps are confirmed by the reporting; the mechanism behind step 3 is not. 1. Attackers gained access to a backend system supporting Bitget's wallet services. 2. Bitget's security team detected unauthorised transfers and activated emergency protocols. 3. The attackers exploited vulnerabilities in that backend system to execute unauthorised transfers out of exchange wallets. 4. Blockchain security firms initially observed more than $175 million leaving the platform on Thursday, with larger transfers following. 5. Total losses were initially estimated at $387.5 million across ETH, XRP, USDC and several other coins. 6. Bitget suspended withdrawals and engaged Mandiant and SlowMist for recovery. Law enforcement and other exchanges were notified. 7. Several platforms froze funds connected to the attackers' wallets. What the source does not give: the specific vulnerability class or CVE, the initial access vector (phishing, credential theft, insider, supply chain compromise of a signing service), the malware or tooling used, persistence mechanism, or command-and-control infrastructure. No CVE is referenced anywhere in the source, and none should be assumed. The phrase "exploited vulnerabilities" in Chen's statement is not accompanied by a technical description, so the flaw could be a software defect, a misconfiguration, or abuse of legitimate signing authority. Treat the mechanism as unknown. Attribution. Chen cited IP addresses, behavioural patterns and on-chain signatures as the basis for linking the attack to North Korean groups. Other blockchain experts traced the stolen funds to past Lazarus Group thefts. Lazarus Group has a MITRE ATT&CK profile (G0032), so the actor is a tracked one, but the attribution here is single-sourced to the victim's own investigation plus unnamed blockchain analysts quoted in one news report. No independent vendor has published a technical report on this incident that we can cite. Treat the DPRK attribution as probable and unconfirmed; do not use it as the sole basis for blocking infrastructure or filing a regulatory report that names an actor. Recovery mechanics. Bitget has opened a recovery bounty: 5% to platforms that voluntarily freeze attacker funds and 5% if funds are recovered. This is a fund-freezing incentive, not a technical control, and it means the attacker's on-chain footprint is being actively contested by multiple exchanges. Clients with on-chain monitoring should expect tainted-fund alerts on any wallet that received Bitget-origin assets. ## 4\. Mitigation & containment P1 within 24 hours - Identify every wallet, custodial account, or settlement path in your estate that touches Bitget, directly or through a prime broker or payment processor. If withdrawals are suspended, confirm whether any client funds are stranded and quantify the exposure. - Screen incoming stablecoin and ETH transfers against the Bitget incident. Any funds originating from Bitget exchange wallets after 24 September 2026 should be held and escalated to compliance before crediting, given the active freeze and bounty programme. - If you hold a Bitget API key or trading credential, revoke it. The backend wallet-services compromise means credential material tied to that platform should be treated as exposed until Bitget states otherwise. - Notify your incident response lead and, if you are a DORA in-scope entity with operational impact, start the Art. 17 incident management process. P2 within 72 hours - Confirm with Bitget, in writing, the status of any client balances and the terms on which the User Protection Fund will be applied. Do not rely on the CEO's town hall statement as a contractual commitment. - Review your ICT third-party register and add or update the Bitget entry with the incident, the withdrawal suspension, and the recovery timeline. This feeds the Art. 28 and Art. 30 obligations above. - If you route stablecoin settlement through Bitget, identify an alternate path now rather than at the point of failure. P3 within 7 days - Reassess concentration: if Bitget is a material counterparty, run the Art. 29 preliminary assessment of ICT concentration risk. - Update on-chain monitoring rules to flag any wallet cluster linked to the Bitget theft, using the tracing published by the blockchain security firms engaged on the recovery (Mandiant, SlowMist) once available. No vendor patch or version pin applies here. The source names no software component, so there is nothing to patch on the client side. The remediation is counterparty and fund-flow control, not endpoint patching. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The reporting describes the incident in financial and attribution terms only. The IP addresses and on-chain signatures Chen referenced were not published. Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | ------------------- | | Large unauthorised transfers out of exchange wallet services | On-chain monitoring of Bitget exchange wallets; exchange withdrawal logs | Confirmed by source | | Withdrawal suspension and emergency protocol activation at the exchange | Bitget platform status; counterparty notifications | Confirmed by source | | Attacker funds frozen by third-party exchanges | On-chain tracing; freeze notices from receiving platforms | Confirmed by source | | Recovery bounty activity (5% freeze / 5% recovery) generating inbound freeze requests | Compliance and on-chain monitoring queues | Confirmed by source | No copyable indicator block is provided because no machine-pivotable atomic indicators exist in the source. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no file hashes, command-line flags, mutex names, registry keys, scheduled-task names, ransom-note text, or hard-coded values. The only artefacts named are the victim (Bitget), the attributed actor (Lazarus Group), and the security firms engaged (Mandiant, SlowMist). None of these are artefacts of the threat itself, and a rule built on them would detect reporting about the incident rather than the incident. No YARA or Sigma rule is emitted. If Mandiant or SlowMist publish a technical report with wallet clusters, IP addresses, or tooling, this section should be revised. ## Threat actor context **Lazarus Group** · [G0032](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. … ## 7\. Sources - Jonathan Greig, The Record (Recorded Future News), "Crypto CEO accuses North Korea of stealing $387 million from Bitget platform", https://therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft, 2026-09-25. Single source. All facts in this advisory derive from this one report, which is itself based on the victim's town hall statements and unnamed blockchain analysts. No independent technical report was available at the time of writing. ## 8\. Adverse Trace position Adverse Trace assesses this as a high-impact theft at a single crypto exchange with probable but unconfirmed DPRK attribution, and no direct technical exposure for EMEA financial services clients unless Bitget sits in their counterparty or settlement chain. The $387.5 million figure is the victim's own initial estimate and has not been independently verified; the attribution rests on one news report and the exchange's internal investigation, so we are not treating it as established. We will monitor for the Mandiant and SlowMist technical reports, for published wallet clusters and IP addresses that would let clients screen fund flows, and for any DORA-relevant operational impact reported by EMEA clients with Bitget exposure. Clients who hold Bitget balances or route stablecoin settlement through the platform should contact their Adverse Trace analyst today so we can scope the exposure against their third-party register. --- [Read the original source →](https://therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*