Crypto exchange Bitget said preliminary evidence suggests North Korean hackers may have been behind a cyberattack that led to the loss of about $351.6 million in digital assets. The company said the investigation is still ongoing and its findings are not yet final.
Bitget CEO Gracy Chen said investigators identified IP addresses linked to VPN services that had previously been used by a North Korean hacking group. In a livestream on X, she also said the attack pattern resembled earlier operations attributed to the country.
According to Chen, the specific method used to penetrate Bitget’s systems is still under technical review. She said the exchange detected unauthorized transfers from some of its wallets on Thursday afternoon U.S. time. The incident involved 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure.
The affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates had put the outflows at about $183 million, but Bitget said those calculations did not capture activity across all impacted blockchains.
Bitget’s security team believes the attacker breached a critical backend wallet system, used it to spoof transfer information, and triggered the exchange’s authorization-signing process. Chen said the breach had been contained, preventing further unauthorized outflows. “Private key compromise has been ruled out,” she said.
Withdrawals remain suspended while technical teams repair and reinforce the affected systems. Deposits and trading continue as normal. Chen did not give a firm timeline for restoring withdrawals, but said the service could return within hours or days and “shouldn’t take weeks.”
Bitget says customer balances remain accurate and that the full loss will be covered by its User Protection Fund, which holds more than $464 million.
Bybit CEO Ben Zhou said his team was ready to assist Bitget. He added that Bybit is updating its LazarusBounty platform to help trace the stolen funds, and noted that Bitget had supported Bybit after its $1.5 billion hack in February 2025.
