How did North Korean hackers steal $350 million worth of crypto from the Bitget exchange? What was their core method of theft? Bitget uses a three-layer wallet architecture: hot wallet, warm wallet, and cold wallet. This time, the hot and warm wallets were compromised, but the cold wallet remained unaffected. The core method North Korean hackers used to steal $350 million from Bitget was bypassing private keys and directly attacking the "brain" of the wallet. In simple terms, they didn’t steal the keys but tricked the system responsible for approving transactions. Core method: forging authorization and deceiving the system. The North Korean attackers didn’t steal Bitget’s private keys or fake user withdrawal requests. Instead, they infiltrated critical backend systems of the wallet infrastructure. Then, they used the compromised system to forge transaction data, making Bitget’s own authorization process mistakenly approve the transfer as a legitimate transaction, thereby enabling the funds to be sent out. Attack origin: suspected North Korean "supply chain attack." During a livestream, Bitget’s CEO revealed that preliminary investigations point to the North Korean hacker group Lazarus Group. The attack pattern resembles a supply chain attack. They may have compromised a third-party tool used by Bitget, which allowed them to manipulate the backend systems. On-chain investigator Specter also discovered that the stolen XRP funds from Bitget were moved cross-chain to the same cluster of addresses linked to the $24 million stolen from the AFX platform in July this year. The AFX attack has already been attributed to Lazarus’s TraderTraitor subgroup. So, this wasn’t a simple “key theft” operation but a sophisticated cyberattack that infiltrated external systems and forged legitimate instructions to bypass the exchange’s internal risk control mechanisms. Both Byebit and Bitget’s shocking theft cases were carried out by North Korean hackers. It’s safe to say this is a state-sponsored operation to grab money.