Bitget disclosed today that suspected North Korean operators drained $351.6 million from its hot and warm wallets. Hot and warm wallets are the ones an exchange keeps connected to move funds quickly, which is also what makes them reachable. The mechanism is not new. What has changed is the pace: this filing lands six days after four governments jointly named the WaterPlum recruiting operation, a separate North Korean scheme that had already pulled $10.71 million from 7,000 wallets over eight months before anyone attached a name to it.

Bitget has not detailed the intrusion vector in its disclosure. What is on the record is the amount, and the amount alone places this above most individual reported thefts attributed to North Korean state operators in 2026. Exchanges that keep large balances in connected wallets are choosing liquidity over custody, and that choice is now a matched entry against a nine-figure loss. North Korean operators have targeted hot wallet infrastructure at exchanges repeatedly enough this year that the pattern is the story, not the specific exploit. Bitget is the named victim. The number is $351.6 million, and that is what regulators in the exchange's operating jurisdictions will now have to reconcile against whatever custody standard they thought was in force.