NEWS | Bitget CEO Gracy Chen said preliminary investigation findings point to North Korean hackers behind the exchange's 351.6 million dollar security breach that happened Thursday. Speaking during a live Q&A on X shortly after the incident, Chen said investigators found IP addresses matching VPN services previously used by a known North Korean hacking group, and said the attack pattern closely resembled past North Korean operations.
The breach involved 19 unauthorized transfers pulled from parts of Bitget's hot and warm wallet systems. Chen explained the attackers did not steal private keys or forge user withdrawal requests, instead breaching a backend system and manipulating it into approving fraudulent transfers on its own. Bitget ruled out an inside job, says all losses are fully covered by its 464 million dollar User Protection Fund, and has already recovered some of the stolen funds, though Chen did not say how much. Withdrawals remain paused while the exchange repairs the affected systems, though deposits and trading are running normally.
BMN sees this as part of a pattern that keeps repeating across the crypto industry. North Korean hackers were already linked to roughly 2 billion dollars in crypto theft last year alone, including the 1.5 billion dollar Bybit hack the FBI directly attributed to them, and this latest case again used a completely different technical method than the one before it.
That constant shift in tactics is exactly what makes this group so hard to stop, exchanges end up defending against last year's playbook while attackers are already several steps ahead with something new.
If the same group keeps finding a new way in every time, is better security even the real fix here, or is this now simply the cost of running a crypto exchange at all?
Your picture beside a comment comes from Gravatar, matched to the email you signed in with. Set one there and it appears here; without one you get your initials. How we handle this