No key wey dem steal, $351 million for 1 hour — Bitget hot-wallet breach and di trust boundary of di approval flow
Bitget confirm on September 25 say about $351.6 million leave parts of im hot and warm wallets for unauthorized transfers wey dem detect at 18:31 UTC on September 24. Di offline cold wallets, as dem report, no dey affected, withdrawals dey paused, and di exchange talk say im $464 million User Protection Fund cover di full loss. As Bitget talk, di attacker no take di private keys but reach backend system and spoof transaction data to steer di approval flow to release funds. We dey look di Lazarus attribution question and di same shape with di management-and-identity-plane theme wey dis observatory cover for recent weeks.
Dis article na machine translation.
Na 18:31 UTC on September 24, 2026, Bitget security systems don flag unauthorized transfers from part of im hot wallets, and emergency response procedures dey activate within minutes. For di 25th, CEO Gracy Chen talk for public say di affected assets total about $351.6 million. Bitget wallet structure na 3-tier (hot / warm / cold); as di exchange talk, di breach stay inside parts of di hot and warm layers and e no reach di offline cold wallets, and customer account balances dey stay consistent with dia holdings. Withdrawals dey temporarily suspended while trading and deposits continue. Di exchange report say e identify and flag di recipient addresses, notify law-enforcement agencies, and engage blockchain-security firms to trace di funds, and say full incident report — wey cover root cause and corrective steps — go follow within 24 hours of di initial notice (as Gracy Chen X statement, Bitget official security notice, Cryptopotato, InvestingLive, and CyberSecurityNews talk).
For di attack path, di story wey Bitget tell na say di attacker reach backend system inside im wallet infrastructure, spoof transaction data, and by dat steer di approval process to release funds. For oda words, as di exchange talk, e no be leak of di private keys wey control di wallets demself. Early estimates from on-chain researchers (analysts such as Arkham Intelligence) run $174M–$183M, about half di confirmed figure; on-chain observers track movements wey involve ETH, BNB, AVAX, USDT, and USDC. 1 notable transaction, as Decrypt report: wallet wey dem just create swap roughly $19.7M of USDT0 (Tether cross-chain version) into 7,111 ETH for about 6 minutes, and pay up to 5% above market price to push di swap through quick. Di exchange User Protection Fund hold $464M, wey pass di loss, and Bitget don commit to cover di full amount from am. TFTC note say di mix of di fund assets never get independent verification.
For attribution: on-chain investigator Specter don claim say di North Korea-linked Lazarus Group dey behind di attack, and HackRead report say Bitget suspect di group involvement, while Bitget itself don decline to attribute formally, as reporting talk say e 'refuse to speculate.' E dey right to call current attribution 'suspicion,' no be 'attribution.' As context, groups wey affiliate with Lazarus, as dem report, don dey involved for many of di largest exchange breaches for recent years — Bybit $1.5B for February 2025 (FBI attribute am to Lazarus), DMM Bitcoin ~$308M and WazirX ~$234.9M for 2024. As Chainalysis talk, 2025 crypto theft total $3.4B, and $2.02B of am (over 60%) dem estimate as North Korea-linked. For di first half of 2026 alone, dem take $1.1B across 212 incidents, a majority wey dem attribute to di Lazarus Group. Dis incident quick multi-chain dispersion, immediate conversion to ETH, and entry through internal system without key leak match operational signatures of state-linked groups — but technique similarity no be evidence of identity.
Analysis (wey we separate from facts): wetin matter na say 'di keys no dey stolen' no be necessarily good outcome. As di story wey Bitget tell, di attacker no take di signing keys but reach di backend system wey dey feed data inside di approval process, and spoof transaction data. Wetin break no be di cryptographic boundary (di keys) but di trust boundary (di source of information for di approval decision). Dis get di same shape as di 'management and identity plane' theme wey dis observatory cover for di last 2 weeks — F5 BIG-IP APM OAuth zero-day (di side wey dey issue identity get unauthenticated RCE), Cisco ISE management-API auth bypass (CVSS 10.0), and Secure Email Gateway root reach through parsing code — all share di structure: when di plane wey dey make di decision itself dey captured, di decision no fit trust again. Di wallet infrastructure approval flow na exactly dat kind of decision plane; di integrity of di balances and transaction data wey dem give am, and di authority of internal systems wey fit create or alter withdrawal requests, define di trust boundary. Di 24-hour report, if e show di backend system wey dey compromised, di approvers wey di spoofed data appear to, and weda multi-step approval fit distinguish 'di spoofed data path' from 'genuine request,' go make di point of failure more concrete. Until den, e dey right to model di failure as 'compromise of di data path inside di approval process.'
Wetin e mean for defense: (1) Operators wey hold on-chain assets suppose treat di approval pipeline itself as first-class trust boundary — no be only key custody, but di provenance of transaction data (authentication/attestation for di API layer, independent data view for each approver, multi-signature with independent views) as design requirement. (2) Set withdrawal velocity and per-chain caps together, and monitor on-chain anomalies (abnormal swap speed, abnormal spread versus market price) as real-time triage signals — dis incident USDT0 → ETH for ~6 minutes at up to 5% premium na exactly dat kind of signal. (3) Because multi-chain dispersion weaken freezing effects, pre-agree freezing/tracing channels with bridge and DEX counterparties. (4) To suspend withdrawals, fast disclosure, and di compensation commitment limit secondary damage — but compensation strong only as far as independent verifiability of di fund size and asset mix, so keep dat verifiability maintained day to day. Facts here draw on Gracy Chen X statement (https://x.com/GracyBitget/status/2103235655879074084), Bitget official security notice (https://www.bitget.com/support/articles/12560603896024), Cryptopotato (https://cryptopotato.com/bitget-reports-351m-hot-wallet-breach-says-user-funds-are-covered/), InvestingLive (https://investinglive.com/cryptocurrency/hackers-drain-351-6-million-from-bitget-in-possibly-2026-s-biggest-crypto-heist/), CyberSecurityNews (https://cybersecuritynews.com/bitget-hot-wallet-hacked/), shattered.io (https://shattered.io/bitget-hack-351-million-2026/), and HackRead (https://hackread.com/bitget-hack-suspects-north-korea-lazarus-group/). Analysis dey kept separate from reporting.