Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that resulted in approximately $351.6 million in unauthorized digital asset transfers. Preliminary evidence includes IP addresses linked to VPN services previously used by a North Korean hacking group, while the specific method used to enter Bitget’s systems remains under investigation.
Key Overview
- Estimated assets affected: $351.6 million
- Unauthorized transfers: 19
- Assets involved: ETH, XRP, USDT, USDC, AVAX and BNB
- Networks affected: Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum
- Cold wallets: Remained secure
- Withdrawals: Suspended
- Trading and deposits: Continue normally
- Protection fund: More than $464 million
- Suspected attackers: North Korean hackers, based on preliminary evidence
Bitget Investigates $351.6 Million Security Breach
Crypto exchange Bitget is investigating a security breach that affected approximately $351.6 million in digital assets.
Bitget CEO Gracy Chen said preliminary evidence suggests that North Korean hackers may be behind the attack. Investigators identified internet protocol addresses linked to VPN services that had previously been used by a North Korean hacking group.
Chen also said the pattern of the attack resembled earlier operations attributed to the country.
However, the specific method used to gain access to Bitget’s systems remains under technical investigation.
19 Unauthorized Transfers Detected
Bitget detected unauthorized transfers from some of its wallets on Thursday afternoon in the United States.
According to Chen, the incident involved 19 transfers from parts of Bitget’s hot and warm wallet infrastructure.
The exchange said its cold wallets remained secure throughout the incident.
The assets affected included Ether, XRP, USDT, USDC, Avalanche and BNB, with transfers occurring across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks.
Earlier on-chain estimates placed the outflows at approximately $183 million, but Bitget said those estimates did not capture activity across all the affected blockchains.
Attackers Compromised Backend Wallet System
Bitget’s security team found that the attacker had breached a critical backend wallet system.
The attacker allegedly used the compromised system to spoof transfer information and then triggered Bitget’s own authorization-signing process to move the digital assets.
Chen said the breach had been contained and further unauthorized outflows had been prevented.
She also said that private key compromise had been ruled out.
The exact method used to enter the backend system remains under investigation.
Withdrawals Remain Suspended
Bitget has suspended withdrawals while its technical teams repair and reinforce the affected systems.
Deposits and trading, however, continue normally.
Chen did not provide a firm timetable for restoring withdrawals but said they could return within hours or days and should not take weeks.
The company said its security teams had brought the situation under control and stopped additional unauthorized transfers.
Context is everything. Stay ahead of shifting trends with today’s market updates, and uncover emerging opportunities using the Serrari Group Market Index and Marketplace. Then, take control of your own financial future by exploring our Money & Life Reset Transformation Blueprint ™ to build stronger habits, create better systems, and design a path toward lasting wealth.
Bitget Says Customer Balances Are Protected
Bitget maintains that customer balances remain accurate following the breach.
The company also said the losses are fully covered by its User Protection Fund, which holds more than $464 million.
The fund is intended to cover the affected assets, according to the exchange.
Some blockchain foundations have also reportedly frozen wallet addresses linked to the attacker, while the stolen assets remain under investigation across the affected networks.
Bybit Offers Assistance
Bybit CEO Ben Zhou said his team was prepared to assist Bitget following the breach.
Zhou said Bybit was updating its LazarusBounty platform to help trace the stolen funds.
The offer follows Bitget’s support for Bybit after the exchange suffered a $1.5 billion hack in February 2025.
The collaboration could support efforts to identify and track the movement of the digital assets involved in the Bitget incident.
Multiple Digital Assets Affected
The stolen funds include ETH, XRP, BNB, AVAX, USDT, and USDC.
The assets were spread across several blockchain networks, including Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum.
XRP accounts for the largest loss on a single chain, according to Chen.
The exchange continues to investigate the movement of the affected assets and the infrastructure used in the attack.
Outlook
Bitget’s investigation remains focused on determining how the attackers gained access to its backend wallet infrastructure and tracing the movement of the stolen digital assets.
The exchange has contained the breach and suspended withdrawals while technical teams reinforce the affected systems. Deposits and trading remain available.
The suspected involvement of North Korean hackers is based on preliminary evidence, including IP addresses linked to previously used VPN services and similarities in the attack pattern. The investigation into the intrusion method is still ongoing.
FAQs
1. How much did the Bitget breach affect?
Bitget estimates that approximately $351.6 million in digital assets were affected.
2. Which cryptocurrencies were involved?
The affected assets included ETH, XRP, USDT, USDC, AVAX and BNB.
3. Were Bitget’s cold wallets affected?
No. Bitget said its cold wallets remained secure during the incident.
4. Are Bitget withdrawals available?
Withdrawals remain suspended while technical teams repair and reinforce the affected systems. Deposits and trading continue normally.
Sources: CNBC, Yahoo Finance, Quartz, SC Media
Your financial future isn’t something you wait for—it’s something you build.
The real question is: when do you begin?
Move beyond simply staying informed.
Navigate the markets with clarity—track trends through the Serrari Group Market Index, uncover opportunities in the Serrari Marketplace, and build practical knowledge with our Curated Wealth Builder Platform.
Stay connected to what truly matters.
Get daily insights on macro trends and financial movements across Kenya, Africa, and global markets—delivered through the Serrari Newsletter.
Growth opens doors.
Advance your career through professional programs including ACCA, HESI A2, ATI TEAS 7 , HESI EXIT , NCLEX – RN and NCLEX – PN, Financial Literacy!🌟—designed to move you forward with confidence.
See where money is flowing—clearly and in real time.
Track Money Market Funds, Treasury Bills, Treasury Bonds, Green Bonds, and Fixed Deposits, alongside global and African indexes, key economic indicators, and the evolving Crypto and stablecoin landscape—all within Serrari’s Market Index.
