Bitget Hacked for $387.5M; CEO Points to North Korea

Crypto exchange Bitget suffered a major security breach on Thursday when unauthorized transfers drained its hot and warm wallets. The company initially estimated losses at $351.6 million but later revised the total to approximately $387.5 million after a fuller accounting of assets including Zcash and additional TRON balances. Cold wallets remained unaffected and withdrawals were suspended while trading continued.

CEO Gracy Chen stated during a livestream that IP addresses and VPN usage patterns match those of a known North Korean hacking group, though she stressed attribution is not yet fully confirmed. Investigators ruled out an inside job or private key compromise, finding instead that attackers breached a critical backend system to spoof transaction data and trigger the exchange's authorized signing process.

“The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.”

On-chain tracker Lookonchain identified the largest haul as 102.93 million XRP worth roughly $157.5 million, followed by 31,890 Ether valued at about $85.8 million, alongside stablecoins and smaller token amounts. The attacker has already swapped most EVM-chain proceeds into 67,982 ETH.

Bitget says its Protection Fund holds over $465 million and can cover the loss independently, with the exchange also holding more than $1 billion in its own capital. The investigation continues with assistance from security firms Mandiant and SlowMist, while Arkham Intelligence has tagged the hacker's wallet.