Bitget CEO says $388M hack fits patterns of North Korean hackers

Bitget says the loss is bigger than first reported

Crypto exchange Bitget says hackers took close to $388 million in digital assets on Thursday, a larger figure than the company first reported. An exchange is a platform where people buy, sell and hold crypto.

Bitget CEO Gracy Chen said on Friday that the higher amount "reflects a more complete accounting of transfers during the incident." She had earlier said more than $350 million had been moved.

Chen also said the attack method matches patterns seen from North Korean hacker groups. Security firms were the first to notice unauthorized transactions from the exchange's hot wallets on Thursday. A hot wallet is a crypto wallet connected to the internet. The company then said it had frozen withdrawals. Bitget is based in Victoria, Seychelles.

The numbers behind the incident

• Close to $388 million in digital assets taken, according to the CEO's updated figure.
• Over $350 million was the amount Chen first reported.
• Bitget is the sixth biggest crypto exchange and handles more than $1 billion in trading volume per day, according to CoinGecko data.
• A stolen funds tracker shows the attacker holds more than $28.8 million in bitcoin.

What Chen said about the attackers

In a post on X on Friday, Chen wrote: "Based on IP behavior patterns and on-chain analysis, the attack method in this incident is highly consistent with known patterns of North Korean hacker organizations." On-chain analysis means studying public blockchain records to trace how funds move.

She added: "Our goal is to complete a full recovery as soon as possible. We will announce the specific time window immediately upon confirmation."

U.S. authorities have long alleged that hacking groups tied to North Korea's government, such as Lazarus, steal from crypto exchanges. Chen's statement is her own assessment based on the exchange's analysis.

What the exchange says was taken

In a security update, Bitget said it identified the digital assets stolen. They were mostly ethereum, tron and the USDT stablecoin, and included no bitcoin. A stablecoin is a crypto token designed to hold a steady value, usually tied to the U.S. dollar.

However, a stolen funds tracker shows the attacker holds over $28.8 million in bitcoin, the leading cryptocurrency. That tracker figure and the exchange's statement about bitcoin do not match.

Confirmed details so far

• Bitget reported unauthorized transfers from its hot wallets on Thursday.
• The exchange said it froze withdrawals.
• The CEO put the total taken at close to $388 million, up from over $350 million.
• Bitget said most of the stolen assets were ethereum, tron and USDT, with no bitcoin.
• The exchange says it has identified the assets involved and wants a full recovery.

Questions that are still open

The North Korea link is described by Chen as "highly consistent" with known patterns of North Korean hacker organizations. The supplied source does not show an independent public confirmation of the attackers' identity.

It is also not clear how the bitcoin shown in the stolen funds tracker relates to the exchange's statement that no bitcoin was taken, or when recovery efforts might be finished. Chen said the timing will be announced once it is confirmed.

Other crypto breaches this year

The Bitget case comes during a run of crypto security incidents. In July, hackers used a firmware bug in the popular bitcoin hardware wallet Coldcard to steal nearly $120 million in user funds. This month, people described as white-hat hackers withdrew about 4,000 bitcoins, worth about $320 million at the time, from Blockstream's Liquid sidechain federation wallet. They returned 85% and demanded to keep the rest as a ransom days later.

The source also notes that crypto theft groups, especially those from North Korea, have become more sophisticated and faster since last year. Experts cited in the source said artificial intelligence tools are helping cyber criminals work more efficiently.

Sources

• Bitcoin Magazine

Read also: Kraken parent Payward expands beyond crypto trading with billions in acquisitions

Read also: Decrypt reports Bitget hack as headline and URL give conflicting loss figures