Bitget says an attacker compromised part of its hot/warm wallet infrastructure, triggering unauthorized transfers worth an estimated $351.6M.
The attacker, "that may be the Lazarus Group as always," allegedly compromised a backend system and spoofed transaction data to bypass authorization. Bitget says private keys were not compromised and the breach has been contained.
Bitget CEO Gracy Chen had said that withdrawals will be resumed on the 26 and that the hack is contained. She also stated that funds are safe and they have launched a bounty program, as did Bybit at the time.
She had also announced that the Bitget Protection Fund exists for moments like this. It holds 5,500 BTC, approximately $464M at current prices.
This is the second-biggest hack for an exchange after the Bybit hack, but like that one, I think the communication coming from the CEX was great, and they have been transparent; that's why their token has taken the shock in a great way: ethereum:0x54d2252757e1672eead234d27b1270728ff90581 fell nearly 3% after the news.