Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.
Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. The pattern of the attack also resembled earlier operations attributed to the country, she said in a livestream on X earlier today.
Chen said the specific intrusion method used to enter Bitget’s systems remain under technical investigation.
Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen.
Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains.
The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Chen said that the breach had been contained, preventing further unauthorized outflows.
“Private key compromise has been ruled out,” she said.
Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally.
While Chen declined to commit to a firm timetable, she said withdrawals could return within hours or days, but “shouldn’t take weeks,” in a broadcast on X a few hours after the attack.
The company maintains that customer balances are accurate and that the loss is fully covered by its User Protection Fund, which holds more than $464 million.
Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bybit is updating its LazarusBounty platform to help trace the stolen funds, Zhou added.