When the Vault Holds and the Process Doesn't: What the $352 Million Bitget Hack Teaches Every Board

On Thursday, crypto exchange Bitget confirmed that attackers had drained roughly $351.6 million in digital assets from its hot and warm wallets. Withdrawals were frozen. Trading kept running. The company's CEO went on a livestream to reassure customers that "the situation is now under control."

For most executives, the instinct is to file this under "crypto problem, not my problem." That instinct is wrong, and not just because a growing number of public companies now hold digital assets on their balance sheets or route payments through exchanges like Bitget. The real lesson here has nothing to do with cryptocurrency. It's about what happens when your technical controls work exactly as designed and you get robbed anyway.

What Actually Happened

According to Bitget's own disclosures, corroborated across multiple outlets, the incident began around 18:31 UTC on September 24. Attackers did not steal a private key. Bitget's CEO, Gracy Chen, was explicit on this point: "private key compromise has been ruled out." Instead, the attackers compromised backend wallet systems, fabricated transaction data, and used that forged data to trigger Bitget's own internal authorization workflow — the process the exchange relies on to approve legitimate withdrawals. Nineteen separate transfers moved funds out across five blockchains (Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum) before anyone caught it.

Here's the detail that should get a board's attention: Bitget's cold storage — the offline vault holding the bulk of customer assets — was never touched. The technical control that was supposed to be the strongest link held. The attackers didn't need to break it. They found a softer target in the approval process that sits around the vault, not inside it.

Bitget says its User Protection Fund, which it states holds more than $464 million, will cover the full loss, and that customer account balances remain accurate. Those are the company's own claims, made within hours of the incident — worth noting as claims, not yet independently audited in public reporting at this writing.

The Attribution Question Nobody Should Skip Past

Chen also said the attack pattern is "highly consistent with known patterns of North Korean hacker organizations," citing IP addresses tied to VPN infrastructure with a history of North Korean-linked activity. That's Bitget's assessment, not a confirmed government attribution. Independent blockchain investigators have offered a more mixed picture: at least one analyst tied the stolen funds to laundering patterns resembling an earlier July hack, while others in the security research community pushed back specifically on the "Lazarus Group" label, arguing it's become a catch-all term applied loosely to any North Korea-adjacent activity rather than a confirmed actor.

This matters beyond the crypto world. When your own vendor or a breached partner tells your board "here's who did it," that attribution is only as solid as the evidence behind it — and reporters, and sometimes companies themselves, have every incentive to reach for the cleanest, most dramatic explanation before the forensic work is finished. Boards should get comfortable asking: is this confirmed, or is this our best current theory?

Applying the Three Questions

Cyber Risk Is Business Risk frames every incident, real or hypothetical, around three questions: What's our exposure? How do we respond? How do we validate what we're being told?

Exposure. If your treasury team holds digital assets, routes vendor payments through a crypto rail, or your company has any counterparty relationship with an exchange, you have exposure to exactly this scenario — a process failure, not a cryptographic one. The same question applies well outside crypto: does your organization's wire transfer approval chain, vendor payment workflow, or any high-value authorization process depend on trusting that the request in front of the approver is genuine? Bitget's attackers didn't crack encryption. They forged the paperwork and walked it through the front door.

Response. Bitget's team detected the anomaly, froze withdrawals, and had a public statement out within hours. Whatever you think of crypto exchanges generally, that is a fast, disciplined incident response cadence — the kind every CISO should be able to point to as the standard for your own organization's tabletop exercises.

Validation. This is where most boards stop too early. A reassuring statement from the company that just lost $352 million is not the same as an independent forensic confirmation. Ask who is validating the claim that customer funds are safe, and on what timeline.

What to Ask Your CISO This Week

• Where in our organization does an approval workflow — not an encryption key — stand as the last line of defense for moving money or data? Wire transfers, vendor payment changes, privileged access requests?
• Have we tested whether someone with backend system access, not just outside credentials, could forge a request that our own approval process would accept as legitimate?
• Do we have any direct or indirect exposure to digital asset custody, whether through treasury holdings, vendor payment rails, or partner relationships?
• When a vendor or partner tells us "your funds are safe" after an incident, what's our process for independently validating that before we repeat it to our own stakeholders?

The Business Risk, Plainly

The headline writes itself as a crypto story. The substance is a governance story: a well-defended technical perimeter got bypassed by attacking the human and procedural layer that sits on top of it. That is not a crypto-specific vulnerability. It is the vulnerability sitting inside nearly every finance and payments workflow in corporate America right now. Boards that treat this as someone else's problem are missing the point of the last three years of cyber incidents: the technology usually isn't the weak link anymore. The process wrapped around it is.