Bitget's North Korea-linked $352 million hack could drain 76% of fund

Bitget said a wallet breach affected $351.6 million in assets. The exchange said the Sept. 24 attack matched techniques used by known North Korean hacking groups. The North Korea attribution remains under investigation and has not been independently confirmed by Mandiant or SlowMist. Bitget reported the incident to authorities and hired Mandiant and SlowMist to investigate. Onchain analyst Specter linked XRP taken from Bitget to funds stolen in the $24 million AFX hack in July. The AFX hack was attributed to the TraderTraitor cluster associated with North Korea's Lazarus Group. The breach affected ETH, XRP, BNB, AVAX, USDT, USDC and other assets. The affected networks included Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base. Gracy Chen said XRP accounted for the largest loss on a single network. Some blockchain foundations confirmed freezes of addresses associated with the attacker. Recoveries could reduce the final loss. Cold wallets remained secure, according to Bitget. Bitget Wallet was unaffected. Withdrawals remain suspended during additional security checks. Bitget said losses remaining after its assessment will be borne by its User Protection Fund. The fund holds 5,500 Bitcoin valued at more than $464 million. A full $351.6 million loss would equal roughly 76% of the fund's value. The eventual draw could be smaller if assets are frozen or recovered. The fund's dollar value can change with Bitcoin's price. Chen disclosed more than $1 billion in proprietary assets. Chen said customer funds remain backed on a 1:1 basis. Bitget has not said how much it will take from the fund or its other resources. The company also has not said what the fund will hold after it makes customers whole. A proof-of-reserves report published Sept. 17 showed a 135% aggregate reserve ratio across 19 assets. The report predates the attack and does not reflect Bitget's post-breach position. Chen said Bitget will announce a reopening window after it completes the security review. Bitget is pursuing asset recoveries and assessing how much of its own balance sheet it may need before customers regain full access.