Bitget Says Suspected North Korean Hackers Stole $351.6 Million From Crypto Wallets
Cryptocurrency exchange Bitget says suspected North Korean hackers stole approximately $351.6 million from its hot and warm wallets.
The company discovered the breach on Thursday evening after its security systems detected multiple fraudulent transfers from a limited number of cryptocurrency wallets.
Bitget suspends withdrawals during investigation
Bitget has temporarily suspended all withdrawals while it investigates the incident with assistance from law enforcement, on-chain security agencies, and cybersecurity experts from Mandiant and SlowMist.
The exchange said Bitget Wallet, its self-custodial wallet service, operates on infrastructure independent of Bitget Exchange and was not affected by the attack. Bitget also said its User Protection Fund, which currently holds 5,500 BTC worth approximately $464 million, will cover any losses.
“Based on our current assessment, approximately $351.6 million in assets were affected. Bitget’s cold wallets and the vast majority of platform assets remain safe and unaffected,” the company said.
“This incident falls within Bitget’s User Protection Fund, which currently holds over $464 million. Customer account balances remain accurate, and deposits and transactions continue as normal.”
Attack affected multiple blockchain networks
Bitget has not yet shared detailed information about how the attackers accessed the key backend wallet service system used to forge transfer information and trigger the authorization signing process.
Bitget CEO Gracy Chen said the incident involved the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base networks. Multiple assets were affected, including ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens. Chen said XRP suffered the largest single-chain loss.
Some blockchain networks have also confirmed that hacker wallet addresses were frozen after the attack, Chen said. She attributed the theft to suspected North Korean hackers.
“Based on IP behavior patterns and on-chain analysis, the attack methodology in this incident is highly consistent with known patterns of North Korean hacker organizations. We have informed the relevant authorities and are fully cooperating with the conduct of the global investigation,” Chen said.
“The attackers compromised a critical backend system within our wallet infrastructure and used it to spoof transaction data and trigger the authorization process to move funds. No further fraudulent transfers are possible. The specific method of system compromise remains under active investigation.”
Bitget said it will resume withdrawals as soon as possible after investigators confirm that it is safe to restore normal operations. The company has provided additional updates about the incident.
North Korean hackers linked to major crypto thefts
North Korean threat groups have previously been implicated in several large-scale cryptocurrency thefts, including the Bybit hack. That attack resulted in the theft of $1.5 billion from cryptocurrency exchange ETH cold wallets, making it the largest crypto heist in history.
Blockchain analysis firm Chainalysis announced two years ago that North Korean hackers had stolen $1.34 billion in 47 cryptocurrency heists throughout 2024. Elliptic estimated in February 2025 that North Korean hackers had “stolen more than $6 billion in cryptocurrencies since 2017.”
The funds were reportedly spent on the country’s ballistic missile program, according to a BBC report.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com