FKey Points:
Trigger Chain: State hackers spoof exchange approval data -> protection fund drained to 83.5% -> same approval-layer playbook viable against the single custodian holding $84 billion in U.S. Bitcoin ETF assets.
Anchoring Statistic: Bitget's $387.5 million loss consumed 83.5% of its $464 million User Protection Fund, leaving roughly $76 million for 125 million users.
Conditional Trigger: If Bitcoin drops 20% from current levels, the remaining $76 million cushion, held in BTC, could fall below zero and effectively vanish as a buffer against a second incident.
Momentum Data Point: North Korean-linked hackers have now stolen over $1 billion in crypto in 2026, up from $643 million at midyear, with their share of global crypto theft rising from 22% in 2022 to 76% this year.
At 2:31 p.m. Eastern last Thursday, 19 transfers walked out of one of the world's largest crypto exchanges. No key was stolen. No employee was bribed. The exchange's own software approved every one. The data fed into it was forged.
If you own a Bitcoin ETF, about 80% of all ETF-held bitcoin sits at one place: Coinbase. The hack did not touch Coinbase. But the same trick drained Bitget. It hit Bybit for $1.5 billion in February of last year. Different lock. Same pick.
I can't stop thinking about this. Bitget is a top-ten exchange by volume. It serves 125 million users. It runs out of the Seychelles. Attackers broke into a backend wallet system. They fed forged transfer data into the approval process. The process did what it was built to do. It approved. CEO Gracy Chen confirmed the method. No stolen keys. No bribed signers. Just spoofed data the computers treated as real. The loss climbed from $351.6 million to $387.5 million as tracers found more addresses on Zcash and TRON. A cryptocurrency called XRP accounted for $157.5 million of that alone.
Legendary investor Stanley Druckenmiller once said:
“You don't get rich by diversifying into 50 mediocre assets. You get rich by finding two or three asymmetric home runs.”
Jeff Brown just found this NEW asymmetric home run he calls “Elon Musk’s One Stock Retirement Plan.” (Click here for details.)
Bitget says its User Protection Fund covers the loss. Here is the math. Before the hack the fund held $464 million. The hack took $387.5 million. That is 83.5 cents of every dollar. Gone in one afternoon. What remains is about $76 million for 125 million users. The fund is held in bitcoin. If BTC drops 20%, that cushion falls below zero. This is not FDIC insurance. No regulator stands behind it. No auditor signs off. It is a promise backed by a shrinking pile of coins. And the pile has been melting all year. The fund was worth $716 million in June of last year. By March of this year it was $451 million. By last Thursday it was $464 million after a bitcoin rally. By Friday it was $76 million.
But the gutted fund is not what keeps me up at night. The fund can be rebuilt. The pattern behind the attack cannot be unlearned. I worry about where the money went. Analytics firm Elliptic says the Bitget hack pushed North Korea's 2026 crypto haul past $1 billion. In less than nine months. A disbanded U.N. panel found that stolen crypto funds roughly 40% of Pyongyang's weapons programs. Russia killed that panel in 2024. The watchdog is gone. The theft is getting faster. Nobody is left to count it.
Take a look at this…
It's a radical "light-speed" device that's turning AI as we know it into "Accelerated AI", making it 100 times faster and 100 times more energy efficient.
In fact, Jensen Huang, Nvidia's founder and CEO, says this device is shattering the limitations of AI and without it, AI can't scale.
If you want to discover what this technology is, why Nvidia is betting billions on it…
And the one stock we believe could be the biggest winner when "Accelerated AI" goes mainstream…
The playbook keeps working. The Bybit hack in February 2025 used the same kind of trick. The FBI pinned it on North Korea. Bybit plugged its hole with bridge loans. Bitget lent Bybit 40,000 Ethereum coins to keep withdrawals open. Now Bitget is the one freezing withdrawals for four days. Nearly all of the Bybit money was never recovered. It went to Pyongyang. North Korea's share of global crypto theft has gone from 22% in 2022 to 76% this year. One country now takes three of every four dollars stolen in crypto on earth.
I don't think most people realize where our ETF money sits at night. Bitcoin ETFs hold about $105 billion. Coinbase Custody holds roughly $84 billion of that across 9 of 12 spot funds. Coinbase's custody insurance caps at $320 million. BlackRock's IBIT alone holds roughly $67.9 billion. That is 212 times the coverage. These funds are set up as trusts. That means they do not carry the same investor protections as a regular stock fund. If something goes wrong at the custodian, your shares may not be whole. The hack did not touch Coinbase. But the trick that fooled Bitget and Bybit targets the approval layer, not the vault. The vault does not matter. What matters is whether the system handing out the keys thinks a forged request is real.
I get it. Crypto fans will say Coinbase is different. The controls are better. The scale is bigger. We hear this after every hack. But companies that run dollar-pegged crypto coins have frozen about $318,000 from the Bitget attack so far. Out of $387.5 million stolen. That is a 0.08% recovery rate. The rest is moving through laundering tools that scramble the trail. It is turning into Ethereum and disappearing. After Bybit, bounties brought back almost nothing. The money does not come back. It becomes warheads.
83.5%. That is how much of the fund one attack consumed. 83.5 cents of every dollar meant to protect 125 million people. One afternoon. One batch of forged data. The country behind it has now stolen over $1 billion in crypto this year. That pace used to take twelve months.
Somewhere tonight a missile engineer in Pyongyang is going to work. His program got funded by one transfer. An exchange's own computer approved it at 2:31 on a Thursday afternoon. The safety net did not catch a thing. It just tore.
More on this tomorrow.
— American Ledger
