Bitget announced today that attackers believed to be affiliated with North Korea have made off with $351.6 million from its hot and warm wallet infrastructure. The platform's security monitoring systems detected the theft Thursday night when they identified a series of illicit fund movements originating from a restricted set of cryptocurrency wallets.
The exchange has halted all withdrawal functionality pending a thorough investigation being conducted alongside law enforcement, blockchain security researchers, and cybersecurity teams from Mandiant and SlowMist. Bitget stated that its self-custodial Bitget Wallet product operates independently from the exchange platform and remained unaffected by the incident. The company also noted that its User Protection Fund, which currently holds approximately 5,500 BTC valued near $464 million, will compensate affected users for their losses.
Based on our current assessment, approximately $351.6 million in assets were affected. Bitget's cold wallets and the overwhelming majority of platform assets remain secure and unaffected.
Bitget
The incident falls within the coverage of Bitget's User Protection Fund, which currently holds more than $464 million. Customer account balances remain accurate, and deposits and trading continue to operate normally.
Bitget
The company has not yet disclosed the specific technical method through which attackers gained access to the critical backend wallet-service infrastructure, though investigators are actively working to determine how the breach occurred. The attackers were able to manipulate transaction records and initiate the authorization-signing workflow to execute the fund transfers.
CEO Gracy Chen identified the compromised blockchains as Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. The stolen assets span multiple token types: ETH, XRP (which represents the largest single-chain loss), BNB, AVAX, USDT, USDC, and additional tokens.
Chen noted that several blockchain networks have already frozen the attacker-controlled wallet addresses since the incident occurred. The company has attributed the breach to North Korean threat actors based on forensic evidence.
Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations. We have reported to relevant institutions and are fully cooperating in conducting a global investigation.
Gracy Chen, Bitget CEO
The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation.
Gracy Chen, Bitget CEO
Bitget stated it will restore withdrawal capabilities once investigators verify that operations can safely resume. The company plans to provide additional details as the investigation progresses.
North Korean-linked threat actors have been connected to numerous significant cryptocurrency thefts in recent years. Most notably, they were responsible for the Bybit heist, in which attackers stole $1.5 billion from the exchange's Ethereum cold storage.