Bitget CEO points to North Korea after $351.6 million hack, citing IP and VPN clues

Bitget CEO Gracy Chen said the exchange’s Thursday security breach may have been carried out by North Korean hackers, based on preliminary findings that linked some IP addresses to VPN services used by a DPRK group. For high-risk operators, the immediate takeaway is the same old one: once funds move out of hot and warm wallet infrastructure, the forensic question becomes less interesting than the containment and recovery playbook.

1. Chen said investigators had found “some IP addresses that match the VPN choices by a certain DPRK group,” and added that the pattern looked “very much like what the North Korean team did before.” She said the exchange did not believe the breach was an inside job.
2. The reported loss was $351.6 million. Bitget said the incident involved unauthorized transfers affecting portions of its hot and warm wallet infrastructure, and withdrawals remained suspended at the time of publication.
3. Chen said the attackers breached Bitget’s systems and transferred funds directly, rather than forging user withdrawal requests. She also said they did not obtain the exchange’s private keys for the cold wallet or any hot, warm wallet.
4. According to Chen, investigators were still determining which systems were compromised and how the attackers gained access. She said some stolen funds had been recovered, but did not specify the amount, and added that Bitget was working with blockchain foundations and other partners on recovery efforts.
5. The North Korea attribution matters because hackers linked to the country were associated with an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack, which the FBI attributed to North Korea.

For PSPs, acquirers, and exchanges in high-risk verticals, this is the uncomfortable part: the headline number is one thing, but the operational signal is the suspension of withdrawals, the wallet scope involved, and whether the attacker touched keys, customer flows, or internal systems. That is the difference between a contained incident and a long cleanup.