Bitget Breach Grows to $388 Million as North Korea Suspicion Mounts
A turbulent week in crypto markets deepened on Friday as exchange Bitget revised the total value of assets stolen in Thursday's security breach upward to approximately $388 million — roughly $35 million more than its initial estimate of $352 million [2]. The exchange said the higher figure reflects a more complete accounting of the original incident after investigators identified additional affected assets on the Zcash and TRON networks, rather than any new unauthorized transfers [2].
The breach touched a wide range of assets and networks, including Ethereum Virtual Machine chains, the XRP Ledger, Zcash and TRON, with affected tokens spanning XRP, Ether, Tether's USDt, USDC, BNB, AVAX and others [2]. Withdrawals remained paused as of Friday while the exchange continued its investigation and ran a bounty program aimed at freezing or recovering stolen funds [2].
The incident ranks among the largest security breaches in crypto history, though it remains well below the roughly $1.5 billion stolen from rival exchange Bybit in February 2025 [2].
Bitget CEO Gracy Chen pointed a finger at North Korea during a live Q&A on X following the incident. "We've identified some IP addresses that match the VPN choices by a certain DPRK group," Chen said, while also stating the exchange did not believe the breach was an inside job [2]. Security investigators flagged similarities with previous North Korean attacks, according to Chen, though she acknowledged the findings were preliminary [2]. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025 alone, including the Bybit hack attributed to the group by the FBI [2]. Chen added that some stolen funds had been recovered, without specifying an amount [2].
KelpDAO Sues LayerZero Over $292 Million Bridge Exploit
Separately, DeFi protocol KelpDAO filed a lawsuit against cross-chain infrastructure provider LayerZero and its co-founder and CEO Bryan Pellegrino over a roughly $292 million exploit of its rsETH bridge [2]. KelpDAO alleged that LayerZero failed to disclose risks in its technology, failed to prevent attackers from compromising its infrastructure, and had reviewed and endorsed KelpDAO's deployment and configuration in writing before the exploit occurred [2].
"Our number one priority has always been and will remain the security of our users' assets," KelpDAO wrote in a statement. "But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem" [2].
Pellegrino called the claim "meritless" and said he would defend the case in Vancouver [2]. The lawsuit escalates a months-long dispute over whether the loss stemmed from LayerZero's infrastructure, KelpDAO's own bridge configuration, or some combination of both [2].
A $15.6 Billion Options Expiry Looms Over Bitcoin
Against this backdrop of security turmoil, Bitcoin is heading into one of the year's largest options settlements. Approximately 182,000 BTC in options contracts worth roughly $15.6 billion are set to expire Friday, with calls accounting for about 106,200 BTC and puts for approximately 75,900 BTC [1].
Significant call open interest is concentrated at the $90,000 and $100,000 strike prices — around 7,222 BTC and 6,950 BTC respectively — while the $70,000 strike holds roughly 8,705 BTC in calls and another 7,653 BTC in puts [1].
The $15.6 billion headline figure does not mean that sum will immediately change hands. Many contracts could expire worthless, and others may already be hedged [1]. What matters for short-term price action is how options dealers adjust their hedges as contracts move in or out of the money — a process that can amplify Bitcoin price swings around large expiry events [1].
Tom Lee's Bull Call Meets a Stubborn Market
The expiry arrives shortly after Fundstrat's Tom Lee made a high-profile bullish call. In a September 21 market note, Lee argued that a crypto bull market was already underway, having begun in late June, citing a rotation from AI back to crypto, strengthening fundamentals around tokenization and AI, and the end of the four-year market cycle [1]. Bitcoin has since slipped below $84,000, and the US 10-year Treasury yield has climbed above 5%, adding pressure on risk assets broadly [1]. Lee's prediction should be understood as his reasoned structural analysis, not settled market fact.
Why Bitcoin's Bear Market Was Shallower This Time
Bitcoin's most recent decline — approximately 55% from its October 2025 peak — was notably smaller than the 75%-plus crashes of prior cycles [1]. Analysts offer competing explanations for the change.
Ryan Rasmussen, director and head of research at Bitwise, pointed to the January 2024 launch of spot Bitcoin ETFs, which gave financial advisers and institutional investors a familiar vehicle for Bitcoin exposure [1]. He noted that a professional investor might allocate around 2% of a portfolio to Bitcoin, compared with 20% or more for crypto-native retail investors — meaning a 50% Bitcoin drop translates to only about a 1% hit to a diversified portfolio [1]. Rasmussen also highlighted portfolio rebalancing: advisers buying after steep declines and trimming after rallies could "soften sell-offs while also limiting the size of rallies" [1].
Mark Connors, chief investment officer at Risk Dimensions, expects growing institutional participation to contribute to smaller drawdowns going forward, adding that greater involvement could result in "smaller blow-off tops due to rebalancing" [1].
Jim Ferraioli, Schwab's director for digital asset research, offered a different lens. He cautioned against automatically equating ETF ownership with institutional ownership, since individuals can buy the funds too [1]. Ferraioli instead pointed to Bitcoin's sheer size: at roughly $2 trillion in market capitalization, the cryptocurrency simply requires far more capital to double than it did when it was worth a few billion dollars [1]. He also estimated that of roughly 20 million Bitcoin in circulation, four million to five million may be lost and another six million to seven million are liquid, with much of the remaining supply rarely moving [1].
What to Watch Next
Several threads will demand attention in the days ahead. The resolution of Friday's $15.6 billion options expiry — and whether price action around key strikes at $70,000, $90,000 and $100,000 produces meaningful volatility — will be closely monitored [1]. On the security front, Bitget's ongoing investigation, the progress of its asset-recovery bounty, and any further attribution of the breach to North Korean actors will shape industry confidence [2]. The KelpDAO-LayerZero lawsuit is likely to become a landmark test of liability standards in cross-chain DeFi infrastructure [2]. And whether Tom Lee's predicted bull market materializes — or gets derailed by rising Treasury yields and macro headwinds — remains the central question hanging over the broader crypto market [1].
