North Korean Hackers Steal $351 Million from Bitget Exchange

Cryptocurrency exchange Bitget has disclosed a $351.6 million theft targeting its hot and warm wallets, an incident the company has attributed to suspected North Korean hackers.

The breach was detected on a Thursday evening after security systems flagged multiple unauthorised transfers. Bitget has since suspended all withdrawals while it conducts an investigation alongside law enforcement, cybersecurity firm Mandiant, and on-chain security specialist SlowMist.

Attackers Compromised Backend Wallet System

Bitget CEO Gracy Chen stated that the attackers compromised a critical backend system within the exchange’s wallet infrastructure. This allowed the hackers to spoof transaction data and trigger the authorisation-signing process to move funds out of the platform.

The theft impacted several blockchains, including Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. The largest single-chain loss was recorded on the XRP Ledger. Stolen assets included ETH, XRP, BNB, AVAX, USDT, and USDC.

User Protection Fund to Cover Losses

The company confirmed that its self-custodial Bitget Wallet was not affected because it operates on infrastructure independent of the Bitget Exchange. Additionally, Bitget’s cold wallets and the majority of platform assets remain secure.

To protect customers, Bitget announced that its User Protection Fund will cover all losses. The fund currently holds more than $464 million in assets. The company stated that customer account balances remain accurate and that deposits and trading will continue to operate normally.

The attribution to North Korea is based on IP behaviour patterns and on-chain analysis, which the company says are highly consistent with known patterns of North Korean hacking organisations. Bitget is continuing its global investigation and will restore withdrawals once investigators confirm it is safe to resume normal operations.