Cryptocurrency exchange Bitget has disclosed a breach in which suspected North Korean hackers stole approximately $351.6 million from its hot and warm wallets. The company said its security systems flagged multiple unauthorized transfers from a limited number of wallets on Thursday evening, prompting an immediate investigation.
Bitget has suspended all withdrawals while it works with law enforcement, on-chain security firms, and cybersecurity researchers at Mandiant and SlowMist to determine the full scope of the intrusion. The company said its cold wallets and the vast majority of platform assets remain secure, and that its self-custodial Bitget Wallet product was unaffected because it runs on separate infrastructure.
According to Bitget, attackers compromised a critical backend system within its wallet infrastructure, used it to spoof transaction data, and triggered the platform’s authorization-signing process to move funds off the exchange. The company says no further unauthorized transfers are possible, though it has not yet disclosed how the attackers initially gained access to the backend system.
Assets and Chains Affected
Bitget CEO Gracy Chen said the incident spanned the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains, and hit multiple assets including ETH, XRP, BNB, AVAX, USDT, and USDC. The single largest chain-specific loss was on XRP Ledger. Chen said some chains have already frozen the attacker-controlled wallet addresses.
Chen attributed the attack to North Korean threat actors, citing IP behavior patterns and on-chain analysis consistent with known tactics used by state-backed North Korean hacking groups. Bitget says it has reported the incident to relevant authorities and is cooperating in a global investigation.
User Funds Covered
Bitget said customer account balances remain accurate and that deposits and trading continue operating normally. The company plans to cover all losses using its User Protection Fund, which currently holds roughly 5,500 BTC worth about $464 million. Withdrawals will resume once investigators confirm it is safe to do so.
The theft adds to a long list of major crypto heists attributed to North Korean hacking groups, including the record $1.5 billion Bybit hack earlier disclosed. Blockchain analysis firms have previously estimated that North Korean-linked actors stole over $1.3 billion across dozens of heists in 2024 alone, and more than $6 billion since 2017, with proceeds reportedly funding the country’s ballistic missile program.