Bitget CEO Says North Korea Link Highly Likely in $351.6 Million Theft

Bitget said a recent large-scale theft of funds was highly likely to be linked to a North Korea-affiliated hacking group.

Bitget Chief Executive Officer Gracy Chen wrote on X on September 25 that the VPN usage patterns of some confirmed IP addresses matched those of a specific North Korea-linked group. Based on the evidence identified so far, the company sees a North Korea connection as highly likely.

Chen said the attack method also differed from a simple theft of private keys. According to her account, the attackers did not obtain the private keys to Bitget’s hot, warm or cold wallets. Instead, they breached the exchange’s internal systems and transferred the funds directly.

Bitget said on September 24 that it had detected unauthorized transfers from some hot wallets and warm wallets, with affected assets estimated at about $351.6 million. The company said its cold wallets were not affected and that it had blocked any additional outflows.

Bitget also said it holds more than $464 million in a user protection fund related to the incident, and that the full amount of the losses falls within the fund’s coverage.

Chen’s remarks, however, amount to an initial assessment based on evidence confirmed so far. Bitget said it is continuing a technical investigation into the attack route and the group behind it, and plans to publish a full incident report once the probe is complete.