A $387 million exploit at derivatives exchange Bitget has been attributed to North Korean state-aligned actors, according to Fortune, in what the outlet describes as the largest cryptocurrency theft of 2025.

The Fortune report places the Bitget breach above every other publicly disclosed crypto theft in the running calendar year. Fortune's framing marks the incident as the year's biggest attack by dollar value, placing it at the top of the 2025 leaderboard for exchange-related losses.

Bitget runs a perpetual-futures and copy-trading platform that processes substantial daily retail volume. A loss of this magnitude tests the venue's proof-of-reserves attestations, its insurance fund coverage, and the speed at which the exchange can socialize remaining exposure through its clawback mechanism. The exchange's response in the days following the Fortune report will determine whether customer balances are fully honored at par.

What does North Korean attribution change?

Attribution to Pyongyang-linked groups carries consequences that extend beyond the immediate dollar loss. North Korean operators have repeatedly targeted centralized exchanges, converting stolen proceeds into hard currency through layered mixing services and over-the-counter desks. Once investigators attribute an incident to a designated-jurisdiction actor, the finding triggers sanctions-screening obligations, cross-border law-enforcement notifications, and the freezing of traced funds through blockchain-analytics partnerships.

The Fortune report does not specify the technical vector used to compromise Bitget. Earlier North Korean operations against exchanges have relied on social-engineering recruiters targeting engineers, supply-chain compromises of wallet software, and private-key extraction from compromised endpoints. The absence of disclosed technical detail limits peer venues' ability to assess lateral risk across shared infrastructure.

How do exchanges typically respond?

Centralized platforms under similar circumstances face pressure to publish the wallet addresses and transaction hashes tied to stolen funds, enabling faster blacklisting across the industry. Bitget had not, at the time of the Fortune report, released an on-chain forensic breakdown of the affected wallets. Investors will weigh that opacity against the exchange's existing reserve attestations and its history of maintaining third-party audit coverage.

The $387 million figure also recalibrates industry loss tallies. Prior year-to-date tracking had quantified several large-exchange incidents well below this single event, lifting the cumulative aggregate for the year and raising the risk premium attached to centralized-venue deposits across the sector.

What to watch next

Bitget's forthcoming technical disclosure will shape whether the breach stemmed from compromised hot-wallet infrastructure, employee-targeted social engineering, or a third-party vendor weakness. The exchange's on-chain footprint — once published — will provide the first concrete signal for liquidity partners and peer venues looking to assess their own exposure.

The Fortune attribution arrives against a wider enforcement backdrop. South Korean, Japanese, and U.S. authorities have tracked North Korean cryptocurrency theft as a national-security concern for years, and a confirmed attribution at this scale is likely to draw formal statements from the relevant sanctions offices within the next several trading days.