Bitget Suspects North Korean Hackers in $352 Million Crypto Breach

Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. She said in a livestream on X earlier today that the pattern of the attack also resembled earlier operations attributed to the country. The specific intrusion method used to enter Bitget’s systems remained under technical investigation, she said.

Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen. The affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains.

The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Chen said the breach had been contained, preventing further unauthorized outflows. “Private key compromise has been ruled out,” she said.

Withdrawals remained suspended while technical teams repaired and reinforced the affected systems, though deposits and trading continued normally. Chen declined to commit to a firm timetable but said withdrawals could return within hours or days and “shouldn’t take weeks” in a broadcast on X a few hours after the attack.

The company maintained that customer balances were accurate and that the loss was fully covered by its User Protection Fund, which holds more than $464 million.

Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bybit is updating its LazarusBounty platform to help trace the stolen funds, Zhou added.