Bitget Reports $387.5 Million Cryptocurrency Theft Following Security Breach
Singaporean cryptocurrency exchange Bitget disclosed that hackers stole more than $387 million from its platform after a security breach occurred on Thursday. The company’s CEO, Gracy Chen, addressed users in a town hall meeting following the incident, stating that forensic evidence pointed to North Korean-linked hackers as the perpetrators. She emphasized that this group has been responsible for stealing billions from cryptocurrency platforms over the past five years.
Chen explained that Bitget’s security team first detected unauthorized transfers on Thursday and immediately initiated emergency response protocols. Blockchain monitoring firms observed initial outflows exceeding $175 million before additional large-scale movements were identified. The CEO confirmed that the final estimated loss totals $387.5 million, encompassing multiple digital assets including ETH, XRP, USDC, and other tokens.
User Protection Fund Activated to Cover Losses
To mitigate the impact on users, Chen confirmed that Bitget’s User Protection Fund, which holds over $464 million, will be used to fully reimburse affected customers. She stated that every dollar lost will be accounted for transparently and that the company remains committed to honoring its obligations despite the significant financial blow.
As a precautionary measure, withdrawals from the Bitget platform have been suspended while the exchange collaborates with cybersecurity firms Mandiant and SlowMist to investigate the breach, trace stolen funds, and support recovery operations. Law enforcement agencies and other cryptocurrency platforms have been notified of the incident to assist in tracking and freezing assets tied to the attackers.
Investigation Traces Attack to North Korean Hacking Groups
Chen detailed that the breach originated from a compromise of Bitget’s backend wallet services, where threat actors exploited existing vulnerabilities to initiate unauthorized transactions. Analysis of IP addresses, behavioral patterns, and on-chain transaction signatures led investigators to conclude that the attack bears the hallmarks of North Korean cyber units.
Independent blockchain analysts later traced portions of the stolen funds to wallets previously associated with the Lazarus Group, a North Korean state-linked hacking collective known for numerous high-profile cryptocurrency heists. According to United Nations investigations, North Korean actors have stolen over $2 billion in cryptocurrency attacks in the past year alone and accumulated approximately $3 billion from such operations between 2017 and 2023.
Context of Recent North Korean Crypto Heists
Chen referenced several recent incidents to underscore the pattern of aggression by these threat actors. Earlier in the year, North Korean hackers were allegedly responsible for stealing $280 million from the Kelp platform and $290 million from Drift through sophisticated schemes involving fictitious companies and social engineering. She also noted that North Korea had stolen $1.5 billion from Dubai-based exchange Bybit in a prior attack, a loss that Bybit managed to survive.
Drawing a parallel, Chen remarked, “If Bybit can hold on after a $1.5 billion loss, we can definitely hold on to a $350 million+ loss,” reinforcing confidence in Bitget’s resilience. She added that the company would not retreat from the challenge and pledged full transparency in its recovery and accountability efforts.
Recovery Bounty Program Launched to Incentivize Fund Freezing
To encourage broader industry cooperation, Chen announced a recovery bounty program offering rewards to platforms that assist in immobilizing or retrieving stolen assets. Under this initiative, exchanges and wallet providers that voluntarily freeze funds linked to the hackers’ wallets will receive 5% of the recovered value. An additional 5% will be awarded if those frozen funds are ultimately recovered and returned to Bitget.
Chen confirmed that several platforms have already begun freezing assets connected to the attackers’ wallets in response to the incident. She concluded by stating that Bitget remains in active coordination with international law enforcement and cybersecurity partners to pursue attribution, recover funds, and strengthen defenses against future threats.
Source: The Record