Bitget suspects North Korea is responsible for $352 million hack

Bitget suspects North Korea is responsible for a $352 million hack. The breach affected about $351.6 million in digital assets. Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. Chen said the attack pattern resembled earlier operations attributed to North Korea. The specific intrusion method remains under technical investigation. Bitget detected 19 unauthorized transfers from parts of its hot and warm wallet infrastructure on Thursday afternoon stateside. Cold wallets remained secure. The affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across five blockchain networks. Earlier on-chain estimates put the outflows at about $183 million. Bitget said those estimates did not capture activity across all affected blockchains. The security team found that the attacker breached a critical backend wallet system. The attacker used the system to spoof transfer information. The attacker triggered Bitget's authorization-signing process. Chen said the breach had been contained to prevent further unauthorized outflows. Chen said investigators had ruled out private key compromise. Withdrawals remain suspended while technical teams repair and reinforce the affected systems. Deposits and trading continue normally. Chen said withdrawals could return within hours or days. Chen said the suspension should not take weeks. Bitget said customer balances are accurate. Chen said the User Protection Fund fully covers the loss. The fund holds more than $464 million. Bybit CEO Ben Zhou said his team was ready to assist Bitget. Bybit is updating its LazarusBounty platform to help trace the stolen funds. Bitget supported Bybit after its $1.5 billion hack in February 2025.