Crypto platform Bitget suspects North Korea is responsible for $352 million hack

Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.

Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. The pattern of the attack also resembled earlier operations attributed to the country, she said in a livestream on X earlier today.

Chen said the specific intrusion method used to enter Bitget’s systems remain under technical investigation.

Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen.

Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains.

The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Chen said that the breach had been contained, preventing further unauthorized outflows.

Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally.

While Chen declined to commit to a firm timetable, she said withdrawals could return within hours or days, but "shouldn't take weeks," in a broadcast on X a few hours after the attack.