Bitget's authorisation system worked exactly as designed. It approved a request no one at Bitget made.

On the evening of 24 September 2026, security systems at Bitget, one of the world's larger cryptocurrency exchanges, flagged unauthorised transfers moving out of the platform's hot and warm wallets. By the time engineers had suspended withdrawals, $351.6 million in ETH, XRP, BNB, AVAX and stablecoins was gone, a figure later revised upward toward $390 million as more affected addresses came to light.

Bitget's own account of the intrusion is unusually specific for an exchange still mid-investigation. Chief executive Gracy Chen said the attacker compromised a critical backend system inside the wallet infrastructure, used it to spoof transaction data, and triggered the exchange's authorisation process to move funds out. Private keys were not touched. Cold storage was not touched. The attacker did not need either: once the backend accepted the spoofed data as genuine, the authorisation process treated a fraudulent transfer request exactly like a legitimate one and signed it off.

Blockchain investigators at SlowMist, working alongside Mandiant, linked the wallet addresses receiving the stolen funds to laundering infrastructure previously used in North Korea's $1.5 billion theft from Bybit in February 2025 and the $292 million KelpDAO bridge hack. The group behind both, tracked by researchers as TraderTraitor, specialises in exactly this kind of intrusion: not smashing through a wallet's cryptography, but working its way into the systems that decide whether a transfer is allowed to happen, then feeding those systems a false answer.

The $351.6 million loss puts Bitget alongside the largest crypto thefts of the year, behind only Bybit's. The exchange says a $464 million user protection fund covers the shortfall and that no customer will lose funds, and stablecoin issuers Circle and Tether have already frozen a portion of the stolen assets in transit. The operational cost sits apart from the balance sheet: withdrawals across the exchange were suspended for four days while engineers rebuilt confidence in the one system customers are meant to trust most.

The defences that failed here were not weak by conventional standards. Bitget ran separated hot, warm and cold wallet tiers, kept the bulk of assets offline, and had monitoring sharp enough to catch the theft in progress rather than days later. Every one of those controls did its job. What none of them did was ask a human being, on a device the attacker did not control, whether this specific transfer should happen. The authorisation process trusted the data it was given. It had no way to ask whether that data was true.

A transfer moving hundreds of millions of dollars out of hot and warm wallets is an execution event, not a routine operation. Under GoFirm, that transfer does not go out on the strength of backend data alone, however convincingly it has been spoofed. Before it executes, a real-time push notification goes to the named authority responsible for wallet operations, on their registered device, over a channel the backend compromise never touches. Confirmation requires their live biometric, not a signature the system extracts from a database it has already been tricked into trusting.

That is the distinction that matters here. Bitget's authorisation process could be fed false data because it lived entirely inside the same infrastructure the attacker had already compromised. GoFirm's confirmation step does not live there. It sits outside the backend, on a device the attacker was never inside, and it cannot be spoofed by forging a transaction record because it does not consult the transaction record at all. It asks the person. A spoofed backend request, however convincingly it mimics a legitimate transfer, cannot produce a biometric confirmation on the real authority's registered device. The execution boundary holds regardless of how convincing the forged data appears.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Lakshmanan, R. 2026. Bitget says suspected North Korean hackers stole $351.6M after backend compromise. The Hacker News, 25 September 2026.
2. Kovacs, E. 2026. North Korea suspected in $351 million Bitget crypto heist. SecurityWeek, 25 September 2026.
3. Gatlan, S. 2026. Hackers steal $351.6 million in Bitget crypto exchange hack. BleepingComputer, 25 September 2026.