Bitget Links $351.6 Million Crypto Heist to North Korean Hackers
Cryptocurrency exchange Bitget has attributed a major security breach resulting in the loss of approximately $351.6 million in digital assets to tactics commonly associated with North Korean state-sponsored threat actors. The company’s CEO, Gracy Chen, made the assertion in a public post on X (formerly Twitter) on Friday, citing IP behavior patterns and on-chain forensic analysis as key evidence supporting the assessment.
Chen did not specify which particular hacking group was responsible, and Bitget has not released the technical details underpinning its conclusion. However, she confirmed that the incident has been reported to the appropriate law enforcement and regulatory authorities for further investigation.
Exchange Infrastructure and Wallet Security Details
Bitget, founded in 2018, operates as a centralized exchange offering spot and derivatives trading for cryptocurrencies. In addition to its trading platform, the company provides Bitget Wallet, a self-custodial wallet service that runs on isolated infrastructure and was confirmed to remain unaffected by the breach.
The unauthorized transfers were detected by Bitget’s internal security systems on September 24. According to the company, the funds were drained from a limited number of its hot wallets — those connected to the internet for operational use — while its cold storage wallets, which hold the majority of user funds offline, were not accessed.
The stolen assets spanned multiple blockchains and included Ethereum (ETH), XRP, Binance Coin (BNB), Avalanche (AVAX), Tether (USDT), and USD Coin (USDC). Among these, XRP constituted the largest portion of losses on any single blockchain.
Attack Vector and Ongoing Investigation
Bitget stated that the precise method used by the attackers to gain initial access has not yet been determined. However, the company confirmed that the intruder compromised a critical backend component within its wallet infrastructure and exploited it to initiate fraudulent transfers that appeared legitimate to internal approval systems.
Importantly, Bitget emphasized that no private keys were extracted or compromised during the incident, suggesting the breach did not involve direct key theft but rather manipulation of transaction authorization processes.
To assist in the investigation, Bitget has enlisted the support of Mandiant, a leading cybersecurity firm, and SlowMist, a blockchain security specialist known for tracking illicit crypto movements. Chen also noted that several blockchain foundations have taken action to freeze wallet addresses identified as linked to the attacker, potentially limiting the hackers’ ability to launder or move the stolen funds.
Context: North Korea’s History of Crypto Theft
The alleged involvement of North Korean actors aligns with a broader pattern of cyberattacks attributed to the country’s state-backed hacking groups. Over recent years, these groups have been linked to the theft of billions of dollars’ worth of cryptocurrency from exchanges, DeFi protocols, and other digital asset platforms worldwide.
One of the most significant incidents cited by authorities was the February 2025 breach of Bybit, in which approximately $1.5 billion was stolen — an attack the FBI formally attributed to North Korean state-sponsored hackers. Other recent cases, including a $290 million loss tied to Kelp DAO, have also been publicly linked to similar threat actors.
While Bitget has not disclosed whether any recovery efforts are underway or if specific sanctions or tracking measures are being pursued, the exchange reiterated its commitment to strengthening security protocols and cooperating with global partners to combat cybercrime in the cryptocurrency sector.
Source: SecurityWeek