CRYPTOCURRENCY exchange Bitget says hackers stole roughly $351.6 million (£276 million) in digital assets, using methods that appear highly consistent with known North Korean threat actors. Chief executive Gracy Chen cited IP behaviour patterns and blockchain analysis in a post on X, but did not identify a specific group or disclose the evidence in detail. The assessment has been reported to relevant authorities and remains an attribution claim, rather than a confirmed identification of the attackers.
Bitget said its security systems detected unauthorised transfers on 24 September from a small number of hot wallets, while its cold wallets were not affected. The stolen assets include ETH, XRP, BNB, AVAX, USDT and USDC across several blockchains, with XRP representing the largest loss on a single chain. Some blockchain foundations have reportedly frozen addresses linked to the attacker.
The exchange has not established how the attackers gained access, but said they compromised a critical backend system in its wallet infrastructure and used it to approve fraudulent transfers; Bitget said private keys were not compromised. Mandiant and SlowMist are assisting the investigation. Bitget Wallet, the company’s self-custodial wallet, operates on separate infrastructure and was not affected.