Threat Intel
Bitget Exchange Loses $351M in Crypto Heist; Possible North Korean Actor Involved
Bitget detected a $351.6 million theft from hot wallets on Sep 24, with evidence pointing to North Korean threat patterns. The exchange’s cold storage remained safe and the incident has been reported to authorities. Defenders should tighten hot‑wallet controls and monitor for similar anomalies.
What Happened
On September 24, Bitget’s monitoring systems detected unauthorized transfers totaling approximately $351.6 million in digital assets from a handful of the exchange’s hot wallets. The activity was halted before further movement, and several addresses linked to the exfiltration have been frozen.
Impact
The loss was confined to hot wallets; Bitget’s cold‑wallet storage and its separate Bitget Wallet infrastructure were not compromised. The exchange has reported the incident to law‑enforcement authorities.
Investigation Findings
Bitget’s CEO stated that IP behavior patterns and on‑chain analysis match known tactics of North Korean threat actors, though no specific group was named and evidence details were not disclosed.
What Defenders Should Do
- Audit hot‑wallet access controls and ensure multi‑factor authentication is enforced.
- Implement real‑time monitoring for anomalous outbound transfers and set thresholds for automated alerts.
- Use on‑chain analytics to trace and flag suspicious wallet activity early.
- Maintain strict separation between hot and cold storage, and keep cold‑wallet keys offline.
- Coordinate with exchanges and law‑enforcement when large transfers are detected.
Mitigation Tips
Regularly review and update security policies for wallet management, enforce least‑privilege access, and conduct periodic penetration tests focused on wallet infrastructure.
Related articles
Citrix NetScaler ADC Vulnerabilities CVE-2026-88771/72 Actively Exploited; Bitget $387M Crypto Theft
Citrix NetScaler ADC and Gateway are under active exploitation due to CVE-2026-88771 and CVE-2026-88772, allowing unauthenticated remote code execution and denial‑of‑service. Bitget cryptocurrency exchange suffered a $387 million theft by North Korean actors. Defenders must patch immediately, monitor for suspicious activity, and review exposed service accounts.
Read briefing
WaterPlum Infected 30,000 Devices via Job‑Seeking Phishing, Stole $10.7M in Crypto
From December 2025 to July 2026, the North Korean group WaterPlum compromised over 30,000 devices worldwide, siphoning more than $10.7 million in cryptocurrency. The campaign, part of the “Contagious Interview” effort, lured job seekers with malicious npm packages and fake interview prompts. Defenders should vet third‑party code, monitor npm traffic, and enforce application whitelisting.
Read briefing
North Korean APT Breaches South Korean Media and Auto Firms via New Linux Toolkit on HAProxy Load Balancers
A suspected North Korean APT deployed a previously undocumented Linux espionage toolkit, dubbed "TED," to compromise HAProxy load balancers in South Korean media and automotive companies. The attackers leveraged the compromised appliances to harvest credentials, redirect traffic, and execute drive‑by downloads, fitting the DPRK pattern of long‑term espionage via trusted software. Rapid7 links the activity to APT37 with medium confidence, highlighting the dual focus on information control and manufacturing IP.
Read briefing
DPRK Lazarus‑style Attack Targets macOS Blockchain Engineers via Discord‑Delivered Python Bot
North Korean actors leveraged a disguised Python arbitrage bot sent through a public Discord channel to compromise macOS systems of blockchain engineers. The multi‑stage malware, KANDYKORN, performs in‑memory binary loading and uses several evasion techniques. Defenders should block the ZIP, monitor for Watcher.py execution, and harden Discord access.
Read briefing