Cryptocurrency exchange Bitget has publicly attributed a $351.6 million breach to the North Korean state-sponsored hacking group Lazarus Group. The incident, which targeted the platform's hot and warm wallets, marks another major financial theft linked to the sanctioned actor and underscores persistent security challenges for the digital asset industry.
Bitget moved quickly to activate its user protection fund, covering all losses and assuring customers that platform operations and assets remained unaffected. While this financial backstop demonstrated operational resilience, analysts noted the core vulnerability exploited in the attack has not been publicly detailed, leaving key questions about the breach's technical root cause unanswered.
The attribution to Lazarus Group, also known as Hidden Cobra, places the hack within a well-documented campaign of state-funded cyber theft. The group, which is a primary revenue source for the DPRK regime, has been implicated in other major exchange breaches, including the 2022 Ronin Network hack and the 2023 CoinEx incident. Their continued success highlights that well-resourced, advanced persistent threat actors represent a systemic risk to the financial sector.
The attack vector specifically targeted hot wallets, which are online by design to facilitate instant trading and liquidity. This necessary functionality presents a larger attack surface compared to offline cold storage. The compromise suggests the attackers likely employed sophisticated techniques, potentially involving social engineering or exploiting zero-day vulnerabilities, to bypass security controls.
For Hong Kong, the incident carries significant implications as the city builds its regulated Web3 ecosystem. Establishing the jurisdiction as a trusted global hub requires cybersecurity to be a foundational priority. A breach of this scale, executed by a state-level adversary, serves as a case study for the necessity of robust, multi-layered defenses and real-time monitoring to protect financial infrastructure and maintain investor confidence.
The event signals to regulators and industry participants across Asia that threat actors are highly capable and persistent. Effective defense will require more than internal security measures; it demands industry-wide threat intelligence sharing and continuous adaptation to the evolving tactics of groups like Lazarus, which exploit both technological and human vulnerabilities with patience and sophistication.
加密貨幣交易所Bitget公開將一宗涉及3.516億美元的資產損失歸咎於朝鮮國家資助的黑客組織Lazarus Group。此次事件針對該平台的熱錢包及溫錢包，標誌著又一宗與受制裁實體相關的重大金融盜竊案件，突顯了數字資產行業持續面臨的安全挑戰。
Bitget迅速啟動用戶保護基金，承擔全部損失，並向客戶保證平台運營及資產未受影響。雖然這項財務支持展現了營運韌性，但分析師指出，攻擊中利用的核心漏洞未被公開詳述，關於此次入侵的技術根本原因仍存在關鍵疑問。
此次事件被歸咎於Lazarus Group（又名Hidden Cobra），使這宗黑客攻擊被納入有案可稽的國家資助網絡盜竊行動中。該組織是朝鮮政權的主要收入來源之一，此前已涉及多宗重大交易所入侵事件，包括2022年Ronin Network及2023年CoinEx事件。其持續得手凸顯了擁有充足資源的高級持續威脅（APT）行為者對金融體系構成的系統性風險。
攻擊載體特別針對熱錢包，這類錢包因其即時交易和流動性需求而在設計上需保持在線狀態。這項必要功能相比離線冷儲存帶來了更大的攻擊面。此次入侵表明攻擊者可能採用了複雜技術，或涉及社交工程或利用零日漏洞，以繞過安全控制措施。
對香港而言，此事件具有重要啟示意義。香港正積極構建受規管的Web3生態系統，要確立該地區作為全球可信樞紐的地位，網絡安全必須成為基礎優先事項。這宗由國家級對手執行、規模如此巨大的入侵事件，成為一個典型案例，說明建立強大、多層次的防禦體系及實時監控機制，對於保護金融基礎設施及維持投資者信心至關重要。
此事件向亞洲各國的監管機構及業界參與者發出信號：威脅行為者能力極高且持續活躍。有效防禦不僅需要內部安全措施；更需全業界的威脅情報共享，並持續適應像Lazarus組織這類群體不斷演變、結合科技與人性弱點且耐心複雜的攻擊策略。