Bitget CEO Points to North Korea in $352M Hack, Citing IP Evidence

Bitget CEO Gracy Chen said North Korean hackers may be behind the exchange’s $351.6 million security breach, pointing to preliminary findings that tie IP addresses to VPN services used by a North Korean group. Speaking in a live Q&A on X after the incident, she said investigators noticed similarities with earlier North Korean attacks and do not believe the breach was an inside job.

IP Address Clues and Attack Pattern

Chen said the team identified IP addresses matching the VPN choices of a certain DPRK group, and that the overall pattern closely resembles past North Korean operations. North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit hack, which the FBI attributed to North Korea.

How the Bitget Hackers Gained Access

Chen said the attackers breached Bitget’s systems and moved funds directly, rather than forging user withdrawal requests or obtaining private keys for the cold, hot or warm wallets. Investigators are still working out which systems were compromised and how the attackers got in.

Recovery Efforts Underway

During the same Q&A, Chen said some stolen funds had already been recovered, without giving a specific amount, and that Bitget is working with blockchain foundations and other partners on further recovery. The comments follow Bitget’s earlier confirmation of unauthorized transfers affecting parts of its hot and warm wallet infrastructure. Withdrawals remain suspended.