Bitget CEO Gracy Chen has linked a $351 million breach at the cryptocurrency exchange to North Korean state-sponsored hackers. During a live Q&A session, Chen said investigators identified IP addresses matching VPNs frequently used by North Korean groups and patterns consistent with previous cyberattacks attributed to the country.
XRP represented the largest portion of stolen funds at approximately $157.5 million, followed by ETH at $85.8 million. The remaining stolen assets included USDT, USDC, USDT0, XAUt, BNB, AVAX, and TRX.
Response and Recovery Efforts
Bitget suspended withdrawals immediately after discovering suspicious fund transfers and alerted law enforcement and security firms. Chen stated that the breach compromised only a portion of the exchange's online wallets, while cold wallets remained secure.
The CEO asserted that user funds are protected, with the full loss amount covered by Bitget's User Protection Fund, which holds over $464 million. She indicated the breach resulted from a direct system compromise rather than exploitation of customer withdrawal channels.
Bitget has recovered some stolen funds and is working with blockchain foundations and industry security partners to recover the remainder. Withdrawals remain suspended for security reasons.
Broader North Korean Hacking Activity
North Korean hackers have been linked to significant cryptocurrency thefts in recent periods. Last year, state-sponsored cybercriminals from North Korea were tied to $2.02 billion in digital asset thefts, and $600 million in the first half of this year.
The Bitget incident follows a February 2025 breach at Bybit, in which the exchange lost roughly $1.5 billion in cryptocurrency. Blockchain investigators attributed that attack to the Lazarus Group, a North Korean state-linked hacking operation. Following the Bitget incident, Bybit's CEO Ben Zhou announced the exchange would assist Bitget in tracing and recovering stolen cryptocurrency.
Infrastructure Vulnerabilities
Blockchain forensics firm TRM Labs noted that sophisticated North Korean attacks systematically target backend infrastructure rather than source code. The firm identified key management, cryptographic signing setups, and multi-layered approval processes as the highest-risk areas for digital asset firms.
TRM Labs advised crypto platforms to prioritize security investments in infrastructure vulnerabilities historically responsible for the most significant financial losses. The firm emphasized that incident response planning, insurance coverage, and treasury reserves should account for the possibility of major infrastructure compromises.
