Bitget

Bitget's authorization-signing process moved $351.6 million across 19 transfers without a private key ever being touched, because attackers spoofed the transfer data the system trusted rather than the keys meant to guard it. Cold wallets held; hot and warm wallets, the parts kept online, were the entire failure domain. Bitget names North Korean IP patterns as a suspect, but the intrusion method itself remains unstated. The signing process checked the message, not the sender.