North Korea Suspected in $352 Million Bitget Hack

Crypto exchange Bitget is pointing the finger at North Korea after roughly $351.6 million in digital assets drained out of its wallets, based on early findings from an investigation the company says is still running.

CEO Gracy Chen laid out the case during a livestream on X, telling viewers that investigators traced internet protocol addresses back to VPN services a North Korean hacking crew had relied on before. The way the operation played out, she added, matched earlier jobs blamed on the regime.

Inside the Breach: 19 Transfers in a Single Afternoon

Here is how the attack unfolded, according to Bitget's security team:

• 19 unauthorized transfers moved funds out of parts of the hot and warm wallet infrastructure on Thursday afternoon US time
• Cold wallets stayed offline and untouched, protecting the bulk of reserves
• Attackers breached a critical backend wallet system, spoofed the transfer details, and pushed the outflows through Bitget's authorization-signing process
• The breach is now contained, with no further leakage
• Private key compromise was ruled out

The exact route used to slip into the backend is still being picked apart by technical teams.

Which Coins and Chains Took the Hit

The stolen haul spanned several heavyweight assets, spread across five networks.

Assets affected:

• Ether (ETH)
• XRP
• Tether (USDT)
• USD Coin (USDC)
• Avalanche (AVAX)
• BNB

Networks involved:

• Ethereum
• XRP Ledger
• Avalanche
• BNB Smart Chain
• Arbitrum

On-chain trackers first pegged the damage at around $183 million. Bitget pushed back on that figure, saying the early analysis missed activity on some of the affected blockchains and undercounted the real total.

Why North Korea Keeps Coming Up

North Korean outfits have become the default suspects whenever a nine-figure exchange theft lands in the headlines. The VPN fingerprints and the choreography of the attack both nudged Bitget toward the same read this time. Chen stopped short of naming a specific group with certainty, framing the North Korea link as preliminary rather than settled.

Are Your Funds Safe? What Bitget Says

For anyone holding a balance on the platform, this is the part that matters. Bitget insists account balances remain accurate and that the full loss is absorbed by its User Protection Fund, a reserve the company values at north of $464 million. In plain terms, the shortfall is covered several times over by that backstop, at least on paper.

When Withdrawals Reopen

Current platform status:

• Withdrawals: suspended while engineers patch and reinforce the affected systems
• Deposits: running normally
• Trading: running normally

Chen would not commit to a firm reopening time, though she suggested the freeze could lift within hours or a few days and stressed it should not drag into weeks.

Exchanges Rally Around Bitget

Rivals moved quickly. Bybit CEO Ben Zhou said his team was on standby to help, returning a favor from earlier in the year: Bitget had backed Bybit after hackers made off with $1.5 billion from that exchange in February 2025, still the biggest crypto theft on record. Zhou added that Bybit is retooling its LazarusBounty platform to help chase down the funds lifted from Bitget.

Why This Hack Should Worry Even Big-Exchange Users

Another nine-figure exploit, another trail pointing toward Pyongyang. The Bitget incident is a hard reminder that even large, well-funded platforms sit one backend flaw away from a very bad afternoon, and that the size of an exchange's insurance fund is no longer a detail users can afford to ignore when deciding where to park their coins. The money is said to be covered. The sharper question is how a signing process got spoofed at all, and whether the next target will be anywhere near as ready.