[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fV3ayqmGRDTwwpOnteLSO7Oq1PY6Ixem6qPtILuO3p-s":3},{"article":4,"iocs":53,"watch_terms":56,"solutions":57,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"664ffdc8-877c-4393-aa85-cc4302356df7","Hackers steal $351.6 million in Bitget crypto exchange hack","hackers-steal-351-6-million-in-bitget-crypto-exchange-hack-4ef5d1","​Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets. [...]","Cryptocurrency exchange Bitget has disclosed a significant hack where suspected North Korean hackers stole $351.6 million from its hot and warm wallets. The company discovered the breach after security systems flagged unauthorized transfers and has temporarily suspended withdrawals while investigating with law enforcement and security experts. Bitget stated that its User Protection Fund will cover all losses, and its self-custodial Bitget Wallet was not affected.","North Korean hackers steal $351.6 million from Bitget crypto exchange hot and warm wallets.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-steal-3516-million-in-bitget-crypto-exchange-hack\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2020\u002F12\u002F21\u002FBitcoin-cryptocurrency.jpg","2026-09-25T08:33:44+00:00","2026-09-25T10:00:09.993634+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Bitget","vendor",{"name":21,"type":22},"North Korean hackers","threat_actor",{"name":24,"type":25},"Bitget Wallet","product",{"name":27,"type":19},"Mandiant",{"name":29,"type":19},"SlowMist","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":30,"icon":32,"name":33,"slug":34},null,"Breaches","breaches",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":47,"value":21,"context":55},"Suspected threat actor group linked to the breach",[18,27,29],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":89,"name":90,"problem":91,"products":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":118,"name":119,"problem":120,"products":121},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":164},"bitget-hot-wallet-hack-3516m-lost-to-suspected-north-korean-threat-actors","Bitget Hot Wallet Hack: $351.6M Lost to Suspected North Korean Threat Actors","The Bitget breach highlights the critical risk of maintaining large balances in internet-connected hot and warm wallets, which are inherently more exposed to sophisticated attackers than cold storage. Suspected North Korean threat actors (likely Lazarus Group) have a well-documented history of targeting crypto exchanges, making them a known and persistent adversary that demands heightened defensive posture. The unauthorized transfers were caught by security monitoring systems, but not before hundreds of millions were exfiltrated, underscoring that detection alone is insufficient without equally rapid automated response and containment capabilities. Exchanges holding customer funds at scale must treat wallet architecture as a critical security control, not merely an operational convenience.",[152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 IR-4: Incident Handling","NIST Cybersecurity Framework: Protect (PR.AC), Detect (DE.CM), Respond (RS.RP)","NIST SP 800-61: Computer Security Incident Handling Guide","ITIL 4: Incident Management Practice","FinCEN Guidance on Convertible Virtual Currency (FIN-2019-G001)","FATF Recommendation 15: New Technologies (Virtual Assets)",{}]