Bitget says attackers used methods consistent with North Korean groups as it weighs recoveries against a potentially massive fund draw.