Bitget disclosed that suspected North Korean actors pulled $351.6 million from its hot and warm wallets starting at 18:31 UTC on September 24. A warm wallet is still an internet-connected signing environment, staged for faster throughput than cold storage, which is the entire point and the entire hole. The exchange has not published the signing mechanism the operators defeated, whether multi-party computation, a compromised device, or a supply-chain foothold in wallet infrastructure. Bitget called it a security incident. The artifact that matters is the wallet tier, not the adjective.

North Korean operators drained $10.71 million from 7,000 crypto wallets over eight months in the WaterPlum campaign this desk reported on September 19, and the FBI's running estimate puts North Korean crypto theft near $500 million a year. Bitget's single-day loss is roughly two-thirds of that annual estimate on its own. The people exposed are Bitget's retail depositors, whose funds sat in a wallet tier optimized for withdrawal speed over custody depth, a tradeoff the exchange chose and did not disclose to users holding balances there. Exchanges keep funds warm because cold storage multi-signature approval slows trading revenue, and North Korean operators have priced that tradeoff for years.

Bitget has not named the malware or the initial access vector. CISA's Wednesday advisory on CVE-2026-5430, the SharePoint, WSO2, and Adobe Commerce authentication bypass under active exploitation, is unrelated infrastructure and no evidence ties it to this theft. What is established is the wallet architecture: hot and warm tiers, connected and drained together, at an exchange that had already told regulators its systems detected the intrusion in progress. Detection during the theft did not stop it.