CEO Points to DPRK as Preliminary Evidence Mounts Cryptocurrency exchange Bitget (@bitget) has confirmed a $351.6 million security breach after unauthorized transfers were detected across por
Cryptocurrency exchange Bitget (@bitget) has confirmed a $351.6 million security breach after unauthorized transfers were detected across portions of its hot and warm wallet infrastructure on September 24, 2026. The incident was identified at 18:31 UTC, prompting the security team to activate emergency response procedures within minutes.
Bitget CEO Gracy Chen (@GracyBitget) said North Korean hackers may be behind the breach, citing preliminary findings linking IP addresses to VPN services used by a North Korean group. Speaking during a live Q&A following the incident, Chen said security investigators had flagged similarities with previous North Korean attacks.She said the exchange did not believe the breach was an inside job.
"We've identified some IP addresses that match the VPN choices by a certain DPRK group," Chen said, referring to the Democratic People's Republic of Korea.She also said the activity followed patterns seen in earlier North Korean operations, raising suspicion around the Lazarus Group.However, attribution remains unconfirmed, and Bitget has said it will not formally speculate until its investigation is complete.
Chen disclosed that hackers breached Bitget's systems and transferred funds directly, rather than forging user withdrawal requests.Investigators concluded that the attackers did not obtain Bitget's cold-wallet or hot-and-warm-wallet private keys.Chen said investigators were still determining which systems were compromised and how the attackers gained access.
Bitget said its offline cold wallets remained secure and that customers' account balances continue to reflect their holdings accurately.According to Chen, the stolen amount is covered by the exchange's User Protection Fund, which held more than $464 million when the incident occurred. Bitget said it has recovered some stolen funds and continues to work with partners on the investigation.
The breach comes against a backdrop of escalating state-linked crypto theft. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack, which the FBI attributed to North Korea.
Sources:Cointelegraph: Bitget CEO suspects North Korea behind $352M hack, citing IP cluesCybersecurity News: Bitget hot wallet hacked, attackers stole $351.6 millionHackread: Bitget confirms $351.6 million hack, suspects North Korea's Lazarus Group
