Attackers stole an estimated USD 351.6 million from Bitget’s hot and warm wallets after allegedly compromising a backend system and manipulating transaction data presented to the exchange’s authorization process. The proceeds were divided among fresh wallets, with smaller portions routed through cross-chain services such as THORChain toward Bitcoin. Bitget’s CEO assessed North Korean involvement as very likely, while TRM identified laundering links to the DPRK-linked Bybit and AFX Bridge thefts and to infrastructure used by TraderTraitor. TRM had not definitively attributed the intrusion when it published the analysis.