Bitget suspects North Korea behind $351.6 million crypto exchange hack
This digest was compiled by AI from multiple sources — links to the originals are below.
Crypto exchange Bitget suspects North Korean hackers are behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation. CEO Gracy Chen said investigators identified IP addresses linked to VPN services previously used by a North Korean hacking group. The exchange said the loss is fully covered by its User Protection Fund, which holds more than $464 million.
Key Facts
- Bitget detected unauthorized transfers from some wallets Thursday afternoon, involving 19 transfers from parts of its hot and warm wallet infrastructure.
- Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks.
- The exchange's security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget's authorization-signing process.
- Bitget's User Protection Fund holds more than $464 million, and the company maintains that customer balances are accurate.
- Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025.
Attack Details
Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure. Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains. The exchange's security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget's authorization-signing process. Chen said that the breach had been contained, preventing further unauthorized outflows, and that private key compromise has been ruled out.
Response and Recovery
Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally. Chen declined to commit to a firm timetable but said withdrawals could return within hours or days, and 'shouldn't take weeks,' in a broadcast on X a few hours after the attack. The company maintains that customer balances are accurate and that the loss is fully covered by its User Protection Fund, which holds more than $464 million. Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bybit is updating its LazarusBounty platform to help trace the stolen funds, Zhou added.
2 sources
Time · lag behind first