[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLN1oJOqleJLxrJvIMFHDYi6I2RabCFZWj65_JFMZ7Gw":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"851fbfa5-750d-4ea3-b842-e32e079bb9de","Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise","bitget-says-suspected-north-korean-hackers-stole-351-6m-after-backend-compromise-0fba6d","Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. \"At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets,\" BitGet said in a post shared on X. \"Bitget's cold wallets and the overwhelming majority of platform assets remain","Cryptocurrency exchange Bitget reported a significant loss of $351.6 million due to a suspected attack by North Korean threat actors. The attackers compromised a backend system within Bitget's wallet infrastructure, spoofing transaction data to move funds from hot and warm wallets. While cold wallets and most platform assets remain secure, withdrawals have been temporarily suspended pending a security review. Bitget is collaborating with Mandiant and SlowMist for the investigation.","North Korean hackers stole $351.6M from Bitget crypto exchange wallets.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fbitget-says-suspected-north-korean.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgpydVf-1UN81MyiMH8sAYBd4xiIBuM52UV7kyWmhhBlqohwuaFwgnP5wVx35gG3dHMWrtw0aoPh2zPLW-NaUI4qc_nmpybfA87lo6bzZmLb4WXnpNkYyEYEYMk7kaHeKH4G01yOeEBm44R8a7uAQmabg1k2pEd7MBRp9FM4QN4uA3rsXxkAfuKLWBUxQd_\u002Fs1600\u002Fbitget.jpg","2026-09-25T10:35:55+00:00","2026-09-25T12:00:10.895741+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"North Korean threat actors","threat_actor",{"name":21,"type":22},"Bitget","vendor",{"name":24,"type":25},"Bitget Wallet","product",{"name":27,"type":22},"Mandiant",{"name":29,"type":22},"SlowMist","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":47,"value":55,"context":56},"TraderTraitor","North Korea-linked group attributed to the attack.",[21,27,29],{"controls":59,"vendors":143},[60,88,114],{"slug":61,"name":62,"problem":63,"products":64},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":61,"product_name":85,"url":86,"description":87},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":89,"name":90,"problem":91,"products":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[93,98,106],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":94,"product_name":95,"url":96,"description":97},"zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"slug":115,"name":116,"problem":117,"products":118},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":164},"north-korean-hackers-exploit-backend-compromise-to-drain-3516m-from-bitget","North Korean Hackers Exploit Backend Compromise to Drain $351.6M from Bitget","Attackers suspected to be North Korean state-sponsored actors compromised Bitget's backend wallet infrastructure and spoofed transaction data to siphon funds from hot and warm wallets — the highest-risk storage tier in any crypto exchange. The root cause centers on insufficient access controls and segmentation around backend systems that had direct authority over live wallet operations. This attack illustrates the catastrophic financial and reputational damage that results when privileged backend systems are reachable, poorly monitored, and able to authorize large-scale fund movements without additional verification layers. The fact that cold wallets remained secure confirms that air-gapped, isolated storage can limit blast radius, but the hot\u002Fwarm wallet exposure was devastating. Incidents of this magnitude underscore why cryptocurrency platforms are prime targets for sophisticated nation-state actors seeking to fund sanctioned regimes.",[149,150,151,152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 IR-4 – Incident Handling","NIST Cybersecurity Framework DE.CM-1 – Network Monitoring","NIST Cybersecurity Framework PR.AC-4 – Access Permissions","MITRE ATT&CK T1565 – Data Manipulation","MITRE ATT&CK G0032 – Lazarus Group (North Korea)","ITIL Service Operation – Incident Management","ISO\u002FIEC 27001 A.9 – Access Control","ISO\u002FIEC 27001 A.13 – Communications Security",{}]