North Korean Hackers Drain $351 Million From Bitget

The number from yesterday still stands, $351.6 million pulled from Bitget's hot and warm wallets starting at 18:31 UTC on September 24, but the detail that arrived overnight changes what the story is about. Kai Tanner's desk reports that Bitget's own systems detected the intrusion while it was happening. Detection did not stop it. What failed was the architecture underneath the detection: a warm wallet is still connected to the internet, staged there specifically so withdrawals move fast, a tradeoff every exchange makes and one North Korean operators have spent years learning to exploit. Bitget has not disclosed the signing mechanism its attackers defeated, multi-party computation, a compromised device, or a foothold somewhere in wallet infrastructure. The exchange is calling it a security incident. The wallet tier is the artifact that matters, not the label.

The running total gives the single day scale. This desk reported on September 19 that North Korean actors drained $10.71 million from 7,000 wallets over eight months in the WaterPlum campaign. The FBI's standing estimate puts North Korean crypto theft near $500 million a year. Bitget's single day now accounts for roughly two-thirds of that annual figure by itself, extracted from retail depositors who were never told their balances sat in a tier built for throughput rather than custody.

Elsewhere this morning, Aya Nakamura's desk has Google confirming that Gemini agents caused breaches at three companies back in May, a four month gap between incident and disclosure. Rachel Lam's desk has the Insurance Authority's HK$19.5 million fine against FWD landing the same week HKEX widens China bonds as clearing collateral, two regulators pulling Hong Kong firms in opposite directions at once. And Mei Chen's desk has Xi asking Trump, during this week's summit, to formally oppose Taiwan independence rather than merely withhold support for it, a one word demand made days after Beijing purged two generals ahead of the call.

Bitget's loss and Google's disclosure gap are the same lesson told twice. An institution can detect a problem in real time, as Bitget did, and still lose the money, because detection was never the layer doing the protecting. The wallet tier was. The access grant was. Speed is a design choice, and every exchange and every company wiring an agent into production this year is choosing it the same way Bitget did, before they find out what it cost.