Bitget CEO Gracy Chen says North Korean hackers may be responsible for the $351.6 million security breach that hit the cryptocurrency exchange on Thursday.
Here is what you need to know about the breach, the suspected North Korean connection and what happens next.
Why Bitget suspects North Korea
Speaking during a live Q&A on X after the attack, Chen said investigators identified IP addresses connected to VPN services previously used by a North Korean group. “The pattern looks very much like what the North Korean team did before,” Chen said, although the investigation has not yet established who was responsible.
The suspicion is important given North Korea’s growing role in cryptocurrency theft. Chainalysis estimates DPRK-linked hackers stole at least $2.02 billion in crypto during 2025, a record for the country and 51% more than in 2024.
That total included the approximately $1.5 billion Bybit theft in February of 2025. The FBI formally attributed that attack to North Korea and identified the operation as TraderTraitor.
On-chain researcher Specter also alleged a connection between the Bitget breach and North Korean hackers after tracing stolen XRP to funds linked to an address associated with the earlier AFX exploit. AFX previously said it suspected TraderTraitor involvement in its $24 million July hack. The blockchain connection, however, does not by itself establish who carried out the Bitget attack.
How did the Bitget hack happen?
Chen said attackers compromised a backend wallet system and used it to initiate unauthorized transfers. Importantly, Bitget says the hackers did not obtain private keys for its hot, warm or cold wallets and did not forge withdrawal requests from individual users.
Bitget officially reported that approximately $351.6 million was affected. The breach was limited to portions of its hot and warm wallet infrastructure. Its cold wallets remained secure.
The company says its User Protection Fund, valued at more than $464 million, is enough to cover the entire loss and that customer balances are still protected.
Are Bitget withdrawals working?
Withdrawals are still temporarily suspended while Bitget completes its security review. Deposits and trading remain operational, according to the exchange’s latest official notice.
Chen also said some of the stolen cryptocurrency had already been recovered, although she did not disclose how much.
Bitget is now working with law enforcement, blockchain foundations and on-chain security companies to trace and potentially freeze more funds. The exchange promised a full incident report covering the root cause and corrective measures within 24 hours of the breach.
