Bitget's $387 Million Theft Left No Regulator To Call
The Payout Nobody Authorized
Bitget's wallet backend approved a set of payouts on September 24 that nobody at Bitget meant to send. The attackers did not steal a private key. They spoofed transaction data inside the exchange's own authorization system, feeding it forged instructions until it signed off on transfers of ether, roughly 103 million XRP worth about $157 million, and USDC. The Hacker News reported the loss at $351 million within hours. Bitget revised the number upward to $387.5 million once its own reconciliation finished, making this the largest crypto theft of the year so far.
CEO Gracy Chen suspended withdrawals and brought in Mandiant and SlowMist, drawing on a User Protection Fund holding more than $464 million to backstop user balances. Chen told reporters investigators had traced the intrusion to IP addresses tied to VPN infrastructure and on-chain movement patterns resembling prior Lazarus Group operations. That is Bitget's internal read of its own incident. No government agency and no UN Panel of Experts has confirmed a North Korean hand in this specific theft. Mandiant's and SlowMist's underlying findings have not been published, and nothing in them has been independently confirmed outside of Bitget's own account.
A License Bitget Never Had
crypto.news confirmed that Bitget holds no license, approval, or registration from the Monetary Authority of Singapore, and sits on MAS's Investor Alert List, the register Singapore keeps of platforms it explicitly warns the public not to trust. Bitget already restricts Singapore residents entirely. It holds no MAS license and never appears anywhere on the regulator's books.
That matters because MAS and FATF have spent 2026 warning banks and licensed virtual asset service providers to screen counterparty exposure to North Korean proliferation financing, funds a UN Panel of Experts has repeatedly traced through crypto theft into weapons programs. That screening obligation, to check counterparties against sanctions and proliferation-financing watchlists before processing a transaction, sits on regulated institutions. It was built assuming the theft itself happens somewhere a regulator can see. Bitget's $387.5 million left the building through a platform no regulator supervises, which means no licensed institution had a transaction to screen or a reason to file a report until the funds moved somewhere regulated. It only gets a shot once the ETH, XRP and USDC surface somewhere licensed, and by then the money has already had a head start moving through wherever does not ask.
Bitget's attribution may hold up. Lazarus Group's fingerprints have been on bigger thefts than this one. No government has confirmed it, no regulator was positioned to stop it, and MAS's warning label did nothing but tell Singapore residents not to open an account. The User Protection Fund payout to affected users has not been confirmed as complete, and the $387.5 million's attribution to North Korea remains Bitget's claim alone.
Sources
- Bitget CEO attributes $387.5m theft to North Korea, details spoofed wallet-authorization attack (therecord.media)
- North Korea Steals $351M From Crypto Exchange Bitget (thehackernews.com)
- Bitget confirms no MAS license as Singapore access stays restricted (crypto.news)