Hackers attributed to North Korea targeted crypto exchange Bitget on Thursday, stealing close to $388 million in digital assets, according to an update from CEO Gracy Chen on Friday. The figure represents a revision from the company's initial report of over $350 million.
Security firms first detected unauthorized transactions from the exchange's hot wallets on Thursday before Bitget announced it had frozen withdrawals. Chen said the higher theft estimate "reflects a more complete accounting of transfers during the incident."
"Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations," Chen wrote on X. The company said it identified the stolen digital assets, which primarily included ethereum, tron, and USDT stablecoin, with no bitcoin reported stolen in the initial assessment. However, a stolen funds tracker indicates the attacker possesses over $28.8 million in bitcoin.
Bitget, which processes over $1 billion in trading volume per day according to CoinGecko data, is the sixth largest crypto exchange. "Our goal is to complete a full recovery as soon as possible," Chen said. "We will announce the specific time window immediately upon confirmation."
U.S. authorities have long alleged that hacking groups with ties to North Korea's government, such as Lazarus, conduct theft operations against crypto exchanges. The incident follows a series of breaches affecting the crypto sector this year, including a July attack on Coldcard hardware wallets that resulted in approximately $120 million in losses, and a recent incident involving Blockstream's Liquid sidechain federation wallet.
