Bitget chief links $387.5 million breach to North Korea

Bitget chief executive Gracy Chen has suggested that North Korean hackers were probably responsible for a security breach that moved roughly $387.5 million worth of cryptocurrency from the exchange's wallets. While this assessment is still unconfirmed, investigators have found internet protocol behavior and on-chain patterns that resemble techniques used by known North Korean hacking organizations.

Bitget has not publicly named a specific group, but the investigation is ongoing with the help of cybersecurity firms Mandiant and SlowMist, as well as relevant authorities. Initially, the company estimated that around $351.6 million worth of assets were transferred to attacker-controlled addresses; however, they later revised this figure upward to approximately $387.5 million after accounting for Zcash and TRON assets.

Bitget's security systems detected unauthorized transfers at 18:31 UTC on September 24, involving both hot and warm wallets, but not cold wallets or the separate self-custodial Bitget Wallet, which uses independent infrastructure. The attacker seems to have compromised a critical backend system within Bitget's wallet infrastructure, manipulating transaction data and triggering authorization processes to transfer assets, without actually stealing private keys.

Once the breach was identified, Bitget remediated the vulnerability and contained the attack, preventing any further unauthorized transfers. The exchange temporarily suspended withdrawals while deposits and trading continued. Bitget has stated that customer account balances remain accurate, and users will not face losses from the breach, as the financial impact is covered by the company's User Protection Fund, valued at over $464 million.

This fund, consisting of 5,500 Bitcoin, is designed to protect users during security events. Bitget has also launched a recovery bounty program to encourage assistance in freezing or recovering stolen assets. Some stolen funds have already been frozen through coordination with industry participants.