Somewhere in Pyongyang, someone is having a very good week. Somewhere at crypto exchange Bitget, a whole lot of people are having the opposite. $351.6 million vanished from hot and warm wallets, and the fingerprints all point in one very familiar direction.

$351.6 Million, One Compromised Backend

Bitget's security systems flagged unauthorized transfers at 18:31 UTC on September 24, and the tally has since landed at $351.6 million — the largest crypto theft of 2026 so far. Notably, Bitget says the attackers never got their hands on private keys. Instead, they reportedly compromised a critical backend system in the exchange's wallet infrastructure and used that access to get fraudulent transfers rubber-stamped as legitimate.

That's the part worth sitting with: this wasn't a brute-force break-in on a vault door, it was a quieter compromise of the approval machinery behind the door. Bitget CEO Gracy Chen says IP behavior and on-chain patterns are "highly consistent" with known North Korean hacking operations, and investigators have already tied some of the traffic to VPN infrastructure previously linked to North Korean state-backed groups.

The Approval System Was the Real Target

Crypto exchanges have spent years hardening the obvious target — private key theft — with cold storage, multisig, and hardware security modules. Attackers, predictably, moved to the next weakest link: the backend logic that decides which transfers get approved in the first place. If you can trick the system into approving your withdrawal, you never need the keys at all.

It's the same pattern that's dogged North Korean cyber operations for years now: patient, well-funded, and increasingly aimed at process and infrastructure rather than brute-force cracking. Bitget has paused withdrawals, brought in Mandiant and SlowMist for a third-party investigation, and plans to resume withdrawals in phases starting September 28.

The lock on the vault door doesn't matter much if someone's already inside the building, quietly approving their own exit paperwork.

If "our backend approval process" isn't something you've had audited recently, that's worth a conversation before it becomes this week's headline instead of someone else's — reach out and let's talk through it.

Source: The Hacker News