According to cryptocurrency exchange Bitget, the hackers who stole approximately $351.6 million in digital assets from its systems used techniques very similar to those used by known North Korean threat actors.
“Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacking organizations,” said Bitget CEO Gracy Chen said in a Friday post on X.
Chen’s post did not name a specific threat group, and Bitget did not elaborate on the evidence underlying its assessment. She said the incident had been reported to the relevant authorities.
Founded in 2018, Bitget operates a centralized exchange for spot and derivatives crypto trading. It also offers Bitget Wallet, a self-managed wallet that the company says runs on separate infrastructure and was not affected.
Bitget said its security systems intercepted the unauthorized transfers on September 24. The funds came from a small number of the exchange’s hot wallets. According to the company, its cold wallets were not touched.
The stolen funds include ETH, XRP, BNB, AVAX, USDT and USDC, spread across multiple blockchains. XRP is responsible for the largest loss on a single chain. According to Chen, some blockchain foundations have frozen wallet addresses associated with the attacker.
The company has not yet figured out how the attacker got in. However, it says the hacker compromised a critical backend system in its wallet infrastructure and misused it to authorize fraudulent transfers. Bitget said private keys were not compromised.
Mandiant and blockchain security company SlowMist are helping with the investigation.
North Korean state-sponsored hackers have stolen billions of dollars worth of cryptocurrencies in recent years. The FBI blamed North Korea for the February 2025 heist in which around $1.5 billion was stolen from Bybit.
Related: $290 million Kelp DAO crypto heist blamed on North Korea
Related: CryptoBandits malware doubles as a backdoor and abuses Tor
Related: The party is over for crypto scammers who went on a spending spree after a $240 million Bitcoin theft
