SlowMist’s investigation traced malicious activity tied to the breach back to Aug. 31 and recovered a customized tool designed to interact with the wallet system’s withdrawal logic. It also identified unauthorized access to a security product’s management platform using an internal employee identity. Bitget CEO Gracy Chen has said stolen internal credentials allowed attackers to issue fraudulent withdrawal commands and bypass risk controls without compromising wallet private keys.
Security researcher Tayvano attributed the attack to North Korea, saying, "These are the same attackers as Bybit, AFX, LayerZero, KelpDAO ... It's North Korea." Bitget has begun restoring withdrawals in phases and replenished its user protection fund to more than $300 million on Sept. 30. The exchange has said customers will be fully covered regardless of whether the stolen funds are recovered.