Cryptocurrency exchange Bitget says the hackers who stole roughly $351.6 million in digital assets from its systems used techniques that closely resemble those of known North Korean threat actors.
“Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations,” Bitget CEO Gracy Chen said in a Friday post on X.
Chen’s post did not name a specific threat group, and Bitget has not detailed the evidence behind its assessment. She said the incident has been reported to the relevant authorities.
Founded in 2018, Bitget runs a centralized exchange for spot and derivatives crypto trading. It also offers Bitget Wallet, a self-custodial wallet that the company says runs on separate infrastructure and was not affected.
Bitget said its security systems caught the unauthorized transfers on September 24. The funds came from a small number of the exchange’s hot wallets. According to the company, its cold wallets were not touched.
The stolen funds include ETH, XRP, BNB, AVAX, USDT and USDC, spread across several blockchains. XRP accounts for the largest loss on a single chain. According to Chen, some blockchain foundations have frozen wallet addresses linked to the attacker.
The company hasn’t yet worked out how the attacker got in. However, it said the hacker compromised a critical backend system in its wallet infrastructure and abused it to get fraudulent transfers approved. Bitget said private keys were not compromised.
Mandiant and blockchain security firm SlowMist are helping with the investigation.
North Korean state-sponsored hackers have stolen billions of dollars’ worth of cryptocurrency in recent years. The FBI blamed North Korea for the February 2025 heist in which roughly $1.5 billion was stolen from Bybit.
Related Content
Nation-State
Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
The US, Japan, Germany and Australia have published a joint report detailing the scope of North Korea’s WaterPlum campaign.
Supply Chain Security
Rust Team Members and Popular Crate Owners Targeted
It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North…
Data Breaches
Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.
Malware & Threats
North Korean Hackers Deploy New Linux Espionage Toolkit
The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance.
Malware & Threats
Rust Supply Chain Attack Linked to North Korean Hackers
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Data Breaches
40,000 Impacted by SafePal Data Breach
Hackers exploited a vulnerability in the order-tracking function of a plugin to access SafePal customer information.
Vulnerabilities
Fresh Windows Zero-Day Exploited in North Korean Cyberattacks
The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.
Supply Chain Security
North Korean Hackers Target Open
The PolinRider campaign has compromised more than 100 legitimate openion stealer to developers
